March to the Beat of Your Own Piezoelectric Drum
Drums! You hit them, and they vibrate. It’s kind of fun. Piezoelectric elements can create electric current when they vibrate. [Will Dana] put two and two together to try and charge his phone on his YouTube channel WillsBuilds embedded below.
It worked… about as well as you might expect. Which is to say: not very well. The random piezo elements [Will] glues to his drum almost certainly aren’t optimized for this use case. Adding weight helps, but it doesn’t look like a tuned system. Even if it was, piezoelectric generators aren’t terribly efficient by nature, and the (small) losses from the required bridge rectifiers aren’t helping. An energy-harvesting chip might have worked better, but it probably wouldn’t have worked well.
Since he cannot produce enough voltage in real time, [Will] opts to charge a capacitor bank that he can dump into the phone once it gets enough charge in it to register with the phone’s circuitry. It takes about 30 minutes drumming to charge the capacitors in parallel, before switching to series to get the voltage up to discharge. The capacitors drain in about a quarter second, probably to no measurable result– but the phone does read as “charging”, which was the goal.
Did it work? Technically, yes. The phone was “charging”. Is it practical? Certainly not. Is it a hack? Undeniably so.
youtube.com/embed/c5p8IywkwLQ?…
When Low SRAM Keeps the DOOM off Your Vape
The PIXO Aspire is a roughly $35 USD vape that can almost play DOOM, with [Aaron Christophel] finding that the only thing that realistically stops it from doing so is that the Cortex-M4-based Puya PY32F403XC MCU only has 64 kB of SRAM. CPU-wise it would be more than capable, with a roomy 16 MB of external SPI Flash and a 323×173 pixel LC touch screen display covering the other needs. It even has a vibration motor to give you some force feedback. Interestingly, this vape has a Bluetooth Low-Energy chip built-in, but this does not seem to be used by the original Aspire firmware.
What [Aaron] did to still get some DOOM vapors on the device was to implement a screenshare firmware, allowing a PC to use the device as a secondary display via its USB interface. This way you can use the regular PC mouse and keyboard inputs to play DOOM, while squinting at the small screen.
Although not as completely overpowered as a recent Anker charging station that [Aaron] played DOOM on, we fully expect vapes in a few years to be perfectly usable for some casual gaming, with this potentially even becoming an original manufacturer’s function, if it isn’t already.
youtube.com/embed/rVsvtEj9iqE?…
A Ruggedized Raspberry Pi for Sailors
Nautical navigation has a long history of innovation, from the compass and chronometer to today’s computer-driven autopilot systems. That said, the poor compatibility of electronics with saltwater has consequently created a need for rugged, waterproof computers, a category to which [Matti Airas] of Hat Labs has contributed with the open-source HALPI2.
Powered by the Raspberry Pi Compute Module 5, the electronics are housed in a heavy duty enclosure made of aluminium, which also serves as a heat sink, and closes with a waterproof seal. It has a wide variety of external connectors, all likewise waterproofed: power, HDMI, NMEA 2000 and NMEA 0183, Ethernet, two USB 3.0 ports, and an external WiFi or Bluetooth antenna. The external ports are plugged into the carrier board by short extension cables, and there are even more ports on the carrier board, including two HDMI connectors, two MIPI connectors, four USB ports, and a full GPIO header. The case has plugs to install additional PG7 or SP13 waterproof connectors, so if the existing external connectors aren’t enough, you can add your own.
Besides physical ruggedness, the design is also resistant to electrical damage. It can run on power in the 10-32 volt range, and is protected by a fuse. A supercapacitor bank preserves operation during a power glitch, and if the outage lasts for more than five seconds, can keep the system powered for 30-60 seconds while the operating system shuts down safely. The HALPI2 can also accept power over NMEA 2000, in which case it has the option to limit current draw to 0.9 amps.
The design was originally created to handle navigation, data logging, and other boating tasks, so it’s been configured for and tested with OpenPlotter. Its potential uses are broader than that, however, and it’s also been tested with Raspberry Pi OS for more general projects. Reading through its website, the most striking thing is how thoroughly this is documented: the site describes everything from the LED status indicators to the screws that close the housing – even a template for drilling mounting holes.
Given the quality of this project, it probably won’t surprise you to hear this isn’t [Matti]’s first piece of nautical electronics, having previously made Sailor HATs for the ESP32 and the Raspberry Pi.
Venus Climate Orbiter Akatsuki’s Mission Has Ended
Japan’s Venus Climate Orbiter Akatsuki was launched on May 21, 2010, and started its active mission in 2015 after an initial orbital insertion failure. Since that time, Akatsuki has continuously observed Venus from orbit until issues began to crop up in 2024 when contact was lost in April of that year due to attitude control issues. Japan’s space agency, JAXA, has now announced that the mission has officially ended on September 18, 2025, after a period of trying to coax the spacecraft back into some level of functionality again.
The Akatsuki spacecraft had six instruments, consisting of cameras covering the visible spectrum, ultraviolet and infrared spectra, as well as an oscillator for radio occultation experiments.
All primary mission goals were successfully completed in April of 2018, but engineers determined Akatsuki was capable of lasting at least another few years. This puts it well past its original design lifespan, and has provided us with much more scientific data than we could have hoped for.
Unfortunately, the shutdown of Akatsuki represents the end of the last active Venus mission, with much uncertainty surrounding any potential upcoming mission to Earth’s near-twin planet. The next potential mission is the Venus Life Finder, as an atmospheric mission penciled in for a 2026 launch. It would take at least until 2028 for a potential orbiter mission to launch, so for the foreseeable future Venus will be left alone, without its artificial moon that has kept it company for a decade.
Regretfully: $3,000 Worth of Raspberry Pi Boards
We feel for [Jeff Geerling]. He spent a lot of effort building an AI cluster out of Raspberry PI boards and $3,000 later, he’s a bit regretful. As you can see in the video below, it is a neat build. As Jeff points out, it is relatively low power and dense. But dollar for dollar, it isn’t much of a supercomputer.
Of course, the most obvious thing is that there’s plenty of CPU, but no GPU. We can sympathize, too, with the fact that he had to strip it down twice and rebuild it for a total of three rebuilds. One time, he decided to homogenize the SSDs for each board. The second time was to affix the heatsinks. It is always something.
With ten “blades” — otherwise known as compute modules — the plucky little computer turned in about 325 gigaflops on tests. That sounds pretty good, but a Framework Desktop x4 manages 1,180 gigaflops. What’s more is that the Framework turned out cheaper per gigaflop, too. Each dollar bought about 110 megaflops for the Pis, but about 140 for the Framework.
So was it good for AI anyway? Predictably, no. While the Pi 5 does have an integrated GPU, llama can’t use the version of Vulkan for speedups. Even a cheap consumer PC can turn in better performance. The Framework without its GPU did about six or seven times better. With the GPU? Around 14X compared to the Pi cluster.
Should you build it? [Jeff] says no, unless you have a very special use case for it. However, we build plenty of things that aren’t super practical. If you have a use for the beast, let us know in the comments.
Even if your cluster isn’t as powerful as this one, you can still pretend it is a Cray. We wonder if ten Pi 5s can beat 1,060 Pi 3s?
youtube.com/embed/8SiB-bNyP5E?…
Computer Has One Instruction, Many Transistors
There’s always some debate around what style of architecture is best for certain computing applications, with some on the RISC side citing performance per watt and some on the CISC side citing performance per line of code. But when looking at instruction sets it’s actually possible to eliminate every instruction except one and still have a working, Turing-complete computer. This instruction is called subleq or “subtract and branch if less-than or equal to zero“. [Michael] has built a computer that does this out of discrete components from scratch.
We’ll save a lot of the details of the computer science for [Michael] or others to explain, but at its core this is a computer running with a 1 kHz clock with around 700 transistors total. Since the goal of a single-instruction computer like this is simplicity, the tradeoff is that many more instructions need to be executed for equivalent operations. For this computer it takes six clock cycles to execute one instruction, for a total of about 170 instructions per second. [Michael] also created an assembler for this computer, so with an LCD screen connected and mapped to memory he can write and execute a simple “hello world” program just like any other computer.
[Michael] does note that since he was building this from Logisim directly he doesn’t have a circuit schematic, but due to some intermittent wiring issues might have something in the future if he decides to make PCBs for this instead of using wire on a cardboard substrate. There’s plenty of other information on his GitHub page though. It’s a unique project that gets to the core of what’s truly needed for a working computer. There are a few programming languages out there that are built on a similar idea.
youtube.com/embed/10Kjh3kQZHY?…
“Simplest” Oscilloscope is a Cunning Vector Display
Superlatives are tricky things. [mircemk]’s guide “How to make Simplest ever Oscilloscope Clock” falls into that category. It’s that word, simplest. Certainly, this is an oscilloscope clock, and a nice one. But is it simple?
There’s a nice oscilloscope circuit with a cute 2″ 5LO38I CRT and EF80 tubes for horizontal and vertical deflection that we’d say is pretty simple. (It’s based on an earlier DIY oscilloscope project [mircemk] did.) The bill of materials is remarkably sparse– but it’s modules that do it. One entry is a DC-DC step up supply to get the needed HV. Another is a LM317 to get 6.3 V to heat the tubes. The modules make for a very simple BOM, but on another level, there’s quite a bit of complex engineering in those little modules.
When we get to the “clock” part of the oscilloscope clock, that quandary goes into overdrive. There’s only one line on the BOM, so that’s very simple. On the other hand, it’s an ESP32. Depending on your perspective, that’s not simple at all. It’s a microcomputer, or at least something that can play at emulating one.
Oh, in the ways that matter to a maker — parts count, time, and effort, this oscilloscope clock is very simple. The fact that its actually a vector display for a powerful little micro just adds to the versatility of the build. We absolutely love it, to be honest. Still, the idea that you can have millions of transistors in a simple project — never mind the “simplest ever” — well, it just seems weird on some level when you think about it.
It all comes back to what counts as “simple”. If we’re taking lines on a BOM, arguably this would be even simpler if you used an existing oscilloscope.
In Cina, al via la corsa per l’innovazione con il suo primo concorso di IA
La città di Karamay, nello Xinjiang, ha ospitato l’apertura della finale e della mostra del primo concorso di applicazioni di intelligenza artificiale. L’evento, svoltosi presso il Museo della Scienza e della Tecnologia, ha visto ventiquattro progetti contendersi i premi finali in nove aree chiave, dalla sanità all’energia industriale fino all’istruzione. La manifestazione ha incluso anche una mostra dei risultati, la firma di accordi e la cerimonia di premiazione, con l’obiettivo di valorizzare il ruolo dell’IA nello sviluppo locale e nella costruzione di una “città del potere computazionale”.
Il concorso, intitolato “Camminare con la digitalizzazione, potenziare lo sviluppo”, è stato organizzato dal Comitato del Partito Municipale e dall’Amministrazione di Karamay, insieme a enti di innovazione e sviluppo digitale. Più di 300 partecipanti, tra esperti, accademici e rappresentanti del settore, hanno preso parte alla competizione. Nel suo intervento, Shi Gang ha sottolineato la trasformazione della città da centro basato sulle risorse a polo fondato sull’innovazione, con l’intelligenza artificiale come motore trainante.
Durante la cerimonia, Wusuer Salamu, accademico dell’Accademia Cinese di Ingegneria, ha evidenziato come l’intelligenza artificiale stia vivendo una fase di profonda integrazione. In particolare, i modelli di grandi dimensioni sono stati descritti come il passaggio da semplici strumenti a veri agenti intelligenti, in linea con la strategia di Karamay di costruire una nuova città della potenza di calcolo.
Il concorso, lanciato a maggio, ha ricevuto la candidatura di 495 progetti presentati da 286 organizzazioni, in settori che spaziavano dall’energia all’agricoltura, dalla sanità alla gestione urbana. Dopo una selezione accurata, 24 progetti sono stati ammessi alla finale. La valutazione si è concentrata sull’innovazione tecnologica, sull’applicazione pratica e sul potenziale di leadership, con un format che prevedeva presentazioni, dimostrazioni e discussioni dirette.
Nella competizione finale il primo premio è stato assegnato al progetto dedicato a una piattaforma di ottimizzazione intelligente basata sui dati per la fratturazione e la sua applicazione pratica sul campo. Il secondo premio è andato a un sistema AIGC e a un agente intelligente per i servizi sanitari, mentre il terzo ha premiato un assistente AI per i servizi governativi, un modello di controllo per la perforazione e un sistema di previsioni meteorologiche. Dodici progetti hanno ricevuto premi di eccellenza.
Oltre alla gara, durante l’evento sono stati firmati sei accordi per progetti chiave in diversi settori. Le innovazioni selezionate saranno accelerate per l’implementazione e la trasformazione a Karamay, in linea con la strategia della città di sviluppare nuova produttività e rafforzare la sua competitività tecnologica.
Il concorso ha rappresentato una vetrina per talenti, tecnologie e progetti di alto livello, rafforzando il ruolo di Karamay come centro emergente nell’economia digitale dello Xinjiang. L’evento ha dimostrato le potenzialità dell’intelligenza artificiale nell’alimentare una crescita economica di qualità e nel fornire nuovo slancio allo sviluppo regionale.
L'articolo In Cina, al via la corsa per l’innovazione con il suo primo concorso di IA proviene da il blog della sicurezza informatica.
Un grave attacco informatico colpisce gli aeroporti europei. Voli fermi
Sabato 20 settembre 2025 un attacco informatico ha colpito un fornitore di servizi utilizzati da diversi aeroporti europei, tra cui Bruxelles, Berlino e Londra-Heathrow. L’incidente ha causato notevoli disagi con ritardi e cancellazioni di voli.
L’aeroporto di Londra Heathrow ha informato i passeggeri che la causa del caos era un “problema tecnico”, mentre l’aeroporto di Bruxelles è stato un po’ più disponibile, ammettendo che la causa principale del problema era un attacco informatico al fornitore terzo dei suoi sistemi di check-in.
Il blocco degli aereoporti europei
La società coinvolta, Collins Aerospace, ha comunicato di essere alle prese con problemi tecnici a livello internazionale che riguardano i sistemi di gestione aeroportuale.
L’azienda ha assicurato che i propri tecnici stanno lavorando per riportare la situazione alla normalità.
“Collins Aerospace sta lavorando per risolvere rapidamente l’inconveniente”, si legge nel comunicato ufficiale pubblicato sui canali social di Heathrow.
A Heathrow, le autorità aeroportuali hanno consigliato ai viaggiatori di verificare lo stato del volo prima di partire da casa e di arrivare con largo anticipo: tre ore per le tratte internazionali e due ore per quelle nazionali.
Anche a Bruxelles l’operatività è compromessa: le procedure di check-in e imbarco vengono eseguite manualmente a causa del blocco dei sistemi automatici, con conseguenti code e possibili cancellazioni.
Situazione critica pure a Berlino, dove il malfunzionamento dei sistemi ha provocato rallentamenti significativi nelle operazioni aeroportuali. Le autorità hanno spiegato che sono già in corso interventi tecnici per risolvere il guasto.
Dallo scalo berlinese è arrivata anche una raccomandazione ai passeggeri: chi deve viaggiare il 20 settembre deve prima confermare con la compagnia se il volo è operativo e recarsi in aeroporto solo dopo aver ottenuto la certezza della partenza.
A differenza di altri hub, l’aeroporto di Francoforte non risulta toccato dall’attacco. Secondo un portavoce, le attività proseguono regolarmente, pur mantenendo alta l’attenzione in attesa che il fornitore di servizi ripristini completamente i sistemi compromessi.
la Supply chain e i rischi per le grandi aziende
In questo contesto storico, assistiamo sempre più spesso a perdite “collaterali” o disservizi legati a problematiche nella supply chain. Non si tratta di disserviI che avvengono direttamente dalle infrastrutture IT delle aziende colpite, ma di violazioni che interessano terze parti e fornitori esterni con cui esse collaborano. Questo scenario mette in evidenza come oggi i fornitori rappresentino un vero e proprio “tallone d’Achille” per la cybersecurity aziendale. Non solo nella produzione, ma anche nella protezione dei dati e dei servizi digitali, è fondamentale prestare la massima attenzione a queste dinamiche.
Gli attacchi alla supply chain possono manifestarsi in molteplici forme: vulnerabilità nei sistemi, infezioni malware, oppure condotte scorrette da parte di dipendenti infedeli. Gli effetti possono essere devastanti, arrivando a causare fermi delle linee produttive e danni a catena su clienti, partner e reputazione aziendale.
Per questo motivo, le attività di controllo e monitoraggio non devono limitarsi alle sole infrastrutture IT interne, ma devono necessariamente estendersi anche ai sistemi tecnologici di partner e fornitori. È fondamentale prevedere nei contratti specifiche clausole che regolamentino gli standard minimi di sicurezza informatica da rispettare.
In un contesto dove ogni anello della catena può rappresentare una vulnerabilità, è indispensabile investire con decisione nella gestione del rischio della supply chain. Il nostro consiglio è di adottare misure concrete che prevedano il diritto di audit, consentendo così al cliente di effettuare controlli periodici sulla sicurezza, per verificare il rispetto dei requisiti stabiliti nei contratti di fornitura. Approfondire questi aspetti non è più un’opzione, ma una necessità strategica per ogni azienda. Questo viene anche richiesto dal NIS2 che riporta che le entità devono adottare misure adeguate e proporzionate per valutare e gestire i rischi, compresi quelli relativi alla sicurezza delle catene di approvvigionamento, e garantiscono che i contratti con i fornitori includano clausole che permettano la verifica della conformità ai requisiti di sicurezza.
Infine, occorre ricordare che, nel momento in cui avviene una violazione, è quasi sempre il brand del cliente finale ad apparire sui giornali, mentre il fornitore coinvolto resta spesso in secondo piano. Un ulteriore motivo per cui la sicurezza nella catena di approvvigionamento non può essere trascurata.
L'articolo Un grave attacco informatico colpisce gli aeroporti europei. Voli fermi proviene da il blog della sicurezza informatica.
Fnirsi IPS3608: A Bench Power Supply With Serious Flaws
Fnirsi is one of those brands that seem to pop up more and more often, usually for portable oscilloscopes and kin. Their IPS3608 bench power supply is a bit of a departure from that, offering a mains-powered PSU that can deliver up to 36 VDC and 8 A in a fairly compact, metal enclosure. Recently [Joftec] purchased one of these units in order to review it and ended up finding a few worrying flaws in the process.
One of the claims made on the product page is that it is ‘much more intelligent than traditional power supplies’, which is quite something to start off with. The visual impression of this PSU is that it’s somewhat compromised already, with no earth point on the front next to the positive and negative banana plug points, along with a tilting screen that has trouble staying put. The USB-C and -A ports on the front support USB-PD 3.0 and a range of fast charge protocols
The ‘intelligence’ claim seems to come mostly from the rather extensive user interface, including a graphing function. Where things begin to fall apart is when the unit locks up during load testing presumably due to an overheating event. After hooking up an oscilloscope, the ripple at 1 VDC was determined to be about 200 mV peak-to-peak at 91 kHz. Ripple increased at higher voltages, belying the ’10 mV ultra-low ripple’ claim.
A quick teardown revealed the cause for the most egregious flaw of the unit struggling to maintain even 144 Watt output: a very undersized heatsink on the SMPS board. The retention issues with the tilting issue seemed to be due to a design choice that prevents the screen from rotating without breaking plastic. While this latter issue could be fixed, the buggy firmware and high ripple on the DC output make this €124 ‘285 Watt’ into a hard pass.
youtube.com/embed/qkTGTxcNuoQ?…
Fire Extinguishers, Optical Density Ratings and Safely Using Home Lasers
After [Ross] from FauxHammer miniature model fame got lured into reviewing laser engravers and similar via the Bambu Lab H2D’s laser module, he found himself getting slightly nervous about the whole ‘safety’ aspect of these lasers. After all, lasers can not only light stuff on fire, but it’s a well-known fact that even reflected laser light can be sufficient to cause permanent damage to your retinas. Or worse.
Since your eyes generally do not regenerate, it makes sense to get caught up on laser safety before turning on one of those plentiful-and-increasingly-affordable home laser systems for engraving and/or cutting.
While the issue of stuff catching on fire is readily solved by having a good CO2 extinguisher – and plan B options – at the ready, for safety glasses it’s significantly more complex. There’s not just the issue of finding glasses that block the wavelength of the laser system that you are using, but also with the right optical density (OD) rating. Every mm of the safety lens material can attenuate a certain amount of laser light at the given wavelength, so the OD rating of your laser safety goggles need to match the laser’s power output level, or you might be living with a false sense of security.
Finally, there is the issue of the smoke and fumes produced by these lasers as they obliterate the target material. Much of what is in this smoke you do not want to breathe in, even ignoring long-term dust and VOC exposure issues, so having a solid fume extraction setup and PPE as necessary are absolute necessities. As [Ross] puts it, you don’t want to breathe in the smell of regret today, for your future self to reflect on a decade from now.
Work safe, work smart, don’t become the subject of a laser safety PSA.
youtube.com/embed/rd6rCU8ZMhY?…
BCacheFS is now a DKMS Module After Exile from the Linux Kernel
It’s been a tense few months for users of the BCacheFS filesystem, as amidst the occasional terse arguments and flowery self-praise on the Linux Kernel mailing list the future of this filesystem within the Linux kernel hung very much in the balance. After some initial confusion about what ‘externally maintained’ means in Linux parlance, it’s now clear that this means that BCacheFS has effectively been kicked out of the kernel as [Linus] promised and will ship as a DKMS module instead. The gory details of this change are discussed in a recent video by [Brodie Robertson].
We covered the BCacheFS controversy in the Linux world a few months ago, amidst reports of data loss and filesystem corruption among its users. Its lead developer, [Kent Overstreet], came to blows with [Linus Torvalds] on the LKML after [Kent] insisted on repeatedly pushing new features into kernel release candidate branches along with rather haughty statements on why he should be able to do this.
To make a long story short, [Linus] didn’t like this and froze BCacheFS support in the current kernel release with all future in-kernel development ceased. Distributions like SuSE have initially said that will disable BCacheFS starting in kernel version 6.17, meaning that users of BCacheFS may now have to install the DKMS module themselves. Some distributions like Arch are likely to include this DKMS module by default, which is something you want to check if you use this filesystem.
youtube.com/embed/aG-nmpCTkoY?…
Test Pattern Generator for SCART and RGB TVs
CRTs don’t last forever, and neither do the electronics that drive them. When you have a screen starting to go wonky, then you need a way to troubleshoot which is at fault. A great tool for that is a pattern generator, but they’re not the easiest to come by these days. [baritonomarchetto] needed a pattern generator to help repair his favourite arcade machine, and decided to make his own DIY Portable RGB CRT Test Pattern Generator.
While he does cite [Nicholas Murray]’s RP2040 test pattern generator as a starting point (which itself builds on the PicoVGA library once featured here), he couldn’t just build one. That worthy project only outputs VGA and because [baritonomarchetto] is in Europe, he needed a SCART connector. Since he’s working on arcade machines, he needed non-SCART RGB signals, too. The arcade signals need to be at higher voltages (TLL level) than the RGB signal you’d find in SCART and VGA.
The upshot is while he’s using [Nicholas]’s code for the RP2040, he’s rolled his own PCB, including a different resistor ladders to provide the correct voltages depending on if he’s dealing with a home TV or arcade CRT. To make life easier, the whole thing runs off a 9V battery.
If you’re wondering what the point of these test patterns is, check out this 1981-vintage pattern generator for some context from the era. If a digital replica doesn’t float your boat, it is possible to recreate the original analog circuitry that generated these patterns back when the CRT was king.
Haasoscope Pro: Open-Everything 2 GHz USB Oscilloscope
Our hacker [haas] is at it again with the Haasoscope Pro, a full redesign of the original Haasoscope, which was a successful Crowd Supply campaign back in 2018.
This new Pro version was funded on Crowd Supply in April this year and increases the bandwidth from 60 MHz to 2 GHz, the vertical resolution from 8 to 12 bits, and the sample rate from 125 MS/s to 3.2 GS/s. Selling for $999 it claims to be the first open-everything, affordable, high-bandwidth, real-time sampling USB oscilloscope.
The firmware and software are under active development and a new version was released yesterday.
The hardware has an impressive array of features packed into a slick aluminum case with quiet 40 mm internal fan and 220 x 165 x 35 mm (8.66 x 6.5 x 1.38 in) form-factor weighing in at 0.9 kg (1.98 lbs). Also available is an active probe supporting up to 2 GHz analog bandwidth.
The Haasoscope Pro is miles ahead of alternatives such as this USB oscilloscope from back in 2010 and you can find a bunch of support material on GitHub: drandyhaas/HaasoscopePro.
youtube.com/embed/CLMbfLL2_jQ?…
Unobtanium No More; Perhaps We Already Have All The Elements We Need
It’s been a trope of the news cycle over the past decade or so, that there’s some element which we all need but which someone else has the sole supply, and that’s a Bad Thing. It’s been variously lithium, or rare earth elements, and the someone else is usually China, which makes the perfect mix of ingredients for a good media scare story. Sometimes these things cross from the financial pages to the geopolitical stage, even at times being cited in bellicose language. But is there really a shortage?
The Colorado School of Mines say perhaps not, as they’ve released a paper from an American perspective pointing out that the USA already has everything it needs but perhaps doesn’t realize it. We’re surprised it seems to have passed unnoticed in a world preoccupied with such matters.
We’ve covered a few stories about mineral shortages ourselves, and some of them even point to the same conclusion reached by the School of Mines, that those mineral riches lie not in the mines of China but in the waste products closer to American industry. In particular they point to the tailings from existing mines, a waste product of which there is a huge quantity to hand, and which once stripped of the metal they were mined for still contain enough of the sought-after ones to more than satisfy need.
The history of mining from medieval lead miners processing Roman tailings to 19th century gold miners discovering that their tailings were silver ore and on to the present day, includes many similar stories. Perhaps the real story is economic both in the publicity side and the mining side, a good scare story sells papers, and it’s just cheaper to buy your molybdenum from China rather than make your own. We’ll keep you posted if we see news of a tailings bonanza in the Rockies.
Hackaday Podcast Episode 338: Smoothing 3D Prints, Reading CNC Joints, and Detecting Spicy Shrimp
This week, Hackaday’s Elliot Williams and Kristina Panos met up over the tubes to bring you the latest news, mystery sound, and of course, a big bunch of hacks from the previous seven days or so.
In Hackaday news, we’ve got a new contest running! Read all about the 2025 Component Abuse Challenge, sponsored by DigiKey, and check out the contest page for all the details. In sad news, American Science & Surplus are shuttering online sales, leaving just the brick and mortar stores in Wisconsin and Illinois.
On What’s That Sound, it’s a results show, which means Kristina gets to take a stab at it. She missed the mark, but that’s okay, because [Montana Mike] knew that it was the theme music for the show Beakman’s World, which was described by one contestant as “Bill Nye on crack”.
After that, it’s on to the hacks and such, beginning with a really cool way to smooth your 3D prints in situ. JWe take a much closer look at that talking robot’s typewriter-inspired mouth from about a month ago. Then we discuss several awesome technological feats such as running code on a PAX credit card payment machine, using the alphabet as joinery, and the invention of UTF-8 in general. Finally, we discuss the detection of spicy shrimp, and marvel at the history of email.
Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!
html5-player.libsyn.com/embed/…
Download in DRM-free MP3 and savor at your leisure.
Where to Follow Hackaday Podcast
Places to follow Hackaday podcasts:
Episode 338 Show Notes:
News:
- 2025 Hackaday Component Abuse Challenge: Let The Games Begin!
- American Science And Surplus Ends Online Sales
What’s that Sound?
- Congratulations to [Montana Mike], the Beakmaniest of them all!
Interesting Hacks of the Week:
- Smooth! Non-Planar 3D Ironing
- A Closer Look Inside A Robot’s Typewriter-Inspired Mouth
- Running Code On A PAX Credit Card Payment Machine
- Jointly Is A Typeface Designed For CNC Joinery
- Complex Wood Joints, Thanks To New Software’s Interactive Features
- 50 Digital Wood Joints by Jochen Gros – WINTERDIENST
- Original Mac Limitations Can’t Stop You From Running AI Models
- UTF-8 Is Beautiful
Quick Hacks:
- Elliot’s Picks:
- Oil-Based Sprengel Pump Really Sucks
- Reverse-Engineering The Milwaukee M18 Diagnostics Protocol
- A 10″ Telescope, Because You Only Live Once
- USB-C PD Decoded: A DIY Meter And Logger For Power Insights
- Kristina’s Picks:
- Making A Laptop With A Mechanical Keyboard
- Hosting A Website On A Disposable Vape
- When Is Your Pyrex Not The Pyrex You Expect?
Can’t-Miss Articles:
hackaday.com/2025/09/19/hackad…
2025 Hackaday Component Abuse Challenge: Let The Games Begin!
In theory, all parts are ideal and do just exactly what they say on the box. In practice, everything has its limits, most components have non-ideal characteristics, and you can even turn most parts…Hackaday
Imagining the CPS-1: An Early 70s 4-bit Microcomputer from Canada
[Michael Gardi] wrote in to let us know about his project: CPS-1: Imagining An Early 70s 4-bit Microcomputer.
The CPS-1 was the first Canadian microprocessor-based computer. It was built by Microsystems International Ltd. (MIL) in Ottawa between 1972 and 1973 and it is unknown how many were made and in what configurations. The CPS-1 supported a 12-bit address bus and a 4-bit data bus. MIL also developed the supporting hardware including RAM. The processor was called the MIL 7114.
[Michael] worked in collaboration with [Zbigniew Stachniak] from York University Computer Museum. [Zbigniew] had developed a MIL CPS-1 Emulator and [Michael]’s job was to implement a front panel hardware interface for the emulator which runs on a Raspberry Pi. The only complication: there are no remaining CPS-1 computers, and no known photographs, so no one can say for sure what a real front panel might have looked like!
With a bit of guess work and 3D printing, as well as some inspiration from contemporaneous hardware such as the DEC PDP-11, [Michael] came up with an implementation. He used an IO extender HAT which adds 32 IO pins to the existing Pi GPIO pins that are accessible via an 3-wire I2C interface. This was enough hardware to support the 26 switches and 29 LEDs on the panel. There’s a brief demo of the custom printed switches in the video embedded below.
If you’re interested in old school 4-bit tech you might also like to check out 4-bit Single Board Computer Based On The Intel 4004 Microprocessor.
youtube.com/embed/tPiEd84HB2M?…
This Week in Security: The Shai-Hulud Worm, ShadowLeak, and Inside the Great Firewall
Hardly a week goes by that there isn’t a story to cover about malware getting published to a repository. Last week it was millions of downloads on NPM, but this week it’s something much more concerning. Malware published on NPM is now looking for NPM tokens, and propagating to other NPM packages when found. Yes, it’s a worm, jumping from one NPM package to another, via installs on developer machines.
It does other things too, like grabbing all the secrets it can find when installed on a machine. If the compromised machine has access to a Github account, a new repo is created named Shai-Hulud, borrowed from the name of the sandworms from Dune. The collected secrets and machine info gets uploaded here, and a workflow also uploads any available GitHub secrets to the webhook.site domain.
How many packages are we talking about? At least 187, with some reports of over 500 packages compromised. The immediate attack has been contained, as NPM has worked to remove the compromised packages, and apparently has added filtering code that blocks the upload of compromised packages.
So far there hasn’t been an official statement on the worm from NPM or its parent companies, GitHub or Microsoft. Malicious packages uploaded to NPM is definitely nothing new. But this is the first time we’ve seen a worm that specializes in NPM packages. It’s not a good step for the trustworthiness of NPM or the direct package distribution model.
Token Impersonation in Azure
There’s an interesting write-up from [Dirk-jan Mollema] detailing his findings regarding Azure impersonation tokens and how to abuse them. This is about the Entra ID service, the identity and access management component of the Azure cloud. Azure has a function that allows a service like Exchange to generate an actor token, allowing the service to interact with the rest of Azure on behalf of a user.
These tokens are just signed JSON Web Tokens (JWTs). For a service to actually use one of these tokens, it’s embedded inside yet another, unsigned JWT. This outer token container has multiple fields indicating the the tenant that signed the inner token and the tenant the request is intended for. You may already wonder, what happens if we could get our hands on one of these double-wrapped tokens, and manipulate the target tenant field?
If an attacker can discover the tenant ID and a valid netId for a user in the victim tenant, one of these impersonation tokens could be generated from the attacker-owned tenant, and then manipulated to point to the victim tenant. From there, the attacker could perform any action as that user. It was an extremely significant flaw, and Microsoft pushed an immediate patch within days. The CVE scores a perfect 10 base score in the CVSS 3.1 scale.
ShadowLeak and Prompt Injection, the Attack That Won’t Go Away
There’s yet another example of weaponizing prompt injections against LLMs, in the form of ShadowLeak. And again, it’s the case where agentic AI can fall to social engineering.
The setup is that the AI is handling incoming emails, and the prompt is hidden inside an incoming email, perhaps as white text on a white background. The real challenge here isn’t sneaking the prompt in, but how to exfiltrate data afterwards. OpenAI’s Deep Research agent includes browser.open, to allow the AI to interact with the Internet. And of course, this gives the agent the ability to send data to a remote endpoint.
Firewall Warnings
SonicWall has announced that their MySonicWall systems were breached, and customers have been warned that their firewall configuration backups may have been compromised. These backups appear to include passwords.
Watchguard Firebox firewalls have an out-of-bounds write that can allow Remote Code Execution (RCE) on firewalls running VPNs with IKEv2. A fix is available for the units that are still actively supported, and it’s possible to mitigate against the flaw.
Inside The Great Wall
There was a huge, 600 GB leak last week, of source code and information about the Great Firewall of China. If you click through, the 600 GB leak is available to download, but it’s not something to download and interact with lightly. Put simply, it’s a lot of data produced by level state-sponsored actors, dealing with rather sensitive capabilities.
Among the non-source files, there are some interesting details, such as how the Chinese firewall has been exported to multiple other countries. The source code itself is still being analyzed, and so far it’s an interesting look into the cat and mouse game that has been long played between the Chinese government and VPN technologies. This leak will likely take quite some time to fully analyze, but promises to provide a significant look into the internals of the Great Firewall.
Bits and Bytes
LG TVs running WebOS had a fun issue, where plugging in a USB drive exposed the files on a web endpoint. The filename to download is specified via a parameter to that url, and that parameter doesn’t do path traversal filtering. This gives arbitrary read access to the whole device filesystem.
Google has uncovered and then squashed the SlopAds advertising fraud campaign. This campaign was a collection of apps that presented themselves as hastily made, “AI slop” apps. But when installed, these apps clicked as fast as they could on ads that paid out for the attackers. This represents 224 malicious applications removed, and was resulting in 2.3 billion ad hits per day.
The Inside Story of the UK’s Great CB Petrol Scam
Looking at gasoline prices today, it’s hard to believe that there was a time when 75 cents a gallon seemed outrageous. But that’s the way it was in the 70s, and when it tripped over a dollar, things got pretty dicey. Fuel theft was rampant, both from car fuel tanks — remember lockable gas caps? — and even from gas stations, where drive-offs became common, and unscrupulous employees found ways to trick the system into dispensing free gas.
But one method of fuel theft that escaped our attention was the use of CB radios to spoof petrol pumps, which [Ringway Manchester] details in his new video. The scam happened in the early 80s, only a few years after CB became legal in the UK but quite a while since illegal use had exploded. The trick involved a CB transceiver equipped with a so-called “burner,” a high-power and highly illegal linear amplifier used to boost the radiated power of the signal. When keyed up in the vicinity of dispensers with digital controls, the dispensing rate on the display would appear to slow down markedly, while the pump itself stayed at the same speed. The result was more fuel dispensed than the amount reported to the cashier.
If this sounds apocryphal, [Ringway] assures us that it wasn’t. When the spoofing was reported, authorities up to and including Scotland Yard investigated and found that it was indeed plausible. The problem appeared to be the powerful RF signal interfering with the pulses from the flowmeter on the dispenser. The UK had both 27 MHz and 934 MHz CB at the time; [Ringway] isn’t clear which CB band was used for the exploit, but we’d guess it was the former, in which case we can see how the signals would interfere. Another thing to keep in mind is that CB radios in the UK were FM, as opposed to AM and SSB in the United States. So we wonder if the same trick would have worked here.
At the end of the day, no matter how clever you are about it, theft is theft, and things probably aren’t going to go well for you if you try to pull this off today. Besides, it’s not likely that pumps haven’t been hardened against these sorts of attacks. Still, if you want a look inside a modern pump to see if you can find any weaknesses, have at it. Just don’t tell them where you heard about it.
youtube.com/embed/DI6OFzDChuQ?…
Threat landscape for industrial automation systems in Q2 2025
Statistics across all threats
In Q2 2025, the percentage of ICS computers on which malicious objects were blocked decreased by 1.4 pp from the previous quarter to 20.5%.
Percentage of ICS computers on which malicious objects were blocked, Q2 2022–Q2 2025
Compared to Q2 2024, the rate decreased by 3.0 pp.
Regionally, the percentage of ICS computers on which malicious objects were blocked ranged from 11.2% in Northern Europe to 27.8% in Africa.
Regions ranked by percentage of ICS computers on which malicious objects were blocked
In most of the regions surveyed in this report, the figures decreased from the previous quarter. They increased only in Australia and New Zealand, as well as Northern Europe.
Changes in percentage of ICS computers on which malicious objects were blocked, Q2 2025
Selected industries
The biometrics sector led the ranking of the industries and OT infrastructures surveyed in this report in terms of the percentage of ICS computers on which malicious objects were blocked.
Ranking of industries and OT infrastructures by percentage of ICS computers on which malicious objects were blocked
In Q2 2025, the percentage of ICS computers on which malicious objects were blocked decreased across all industries.
Percentage of ICS computers on which malicious objects were blocked in selected industries
Diversity of detected malicious objects
In Q2 2025, Kaspersky security solutions blocked malware from 10,408 different malware families from various categories on industrial automation systems.
Percentage of ICS computers on which the activity of malicious objects from various categories was blocked
The only increases were in the percentages of ICS computers on which denylisted internet resources (1.2 times more than in the previous quarter) and malicious documents (1.1 times more) were blocked.
Main threat sources
Depending on the threat detection and blocking scenario, it is not always possible to reliably identify the source. The circumstantial evidence for a specific source can be the blocked threat’s type (category).
The internet (visiting malicious or compromised internet resources; malicious content distributed via messengers; cloud data storage and processing services and CDNs), email clients (phishing emails), and removable storage devices remain the primary sources of threats to computers in an organization’s technology infrastructure.
In Q2 2025, the percentage of ICS computers on which threats from email clients were blocked continued to increase. The main categories of threats from email clients blocked on ICS computers are malicious documents, spyware, malicious scripts and phishing pages. The indicator increased in all regions except Russia. By contrast, the global average for other threat sources decreased. Moreover, the rates reached their lowest levels since Q2 2022.
Percentage of ICS computers on which malicious objects from various sources were blocked
The same computer can be attacked by several categories of malware from the same source during a quarter. That computer is counted when calculating the percentage of attacked computers for each threat category, but is only counted once for the threat source (we count unique attacked computers). In addition, it is not always possible to accurately determine the initial infection attempt. Therefore, the total percentage of ICS computers on which various categories of threats from a certain source were blocked exceeds the percentage of threats from the source itself.
The rates for all threat sources varied across the monitored regions.
- The percentage of ICS computers on which threats from the internet were blocked ranged from 6.35% in East Asia to 11.88% in Africa
- The percentage of ICS computers on which threats from email clients were blocked ranged from 0.80% in Russia to 7.23% in Southern Europe
- The percentage of ICS computers on which threats from removable media were blocked ranged from 0.04% in Australia and New Zealand to 1.77% in Africa
- The percentage of ICS computers on which threats from network folders were blocked ranged from 0.01% in Northern Europe to 0.25% in East Asia
Threat categories
A typical attack blocked within an OT network is a multi-stage process, where each subsequent step by the attackers is aimed at increasing privileges and gaining access to other systems by exploiting the security problems of industrial enterprises, including technological infrastructures.
It is worth noting that during the attack, intruders often repeat the same steps (TTPs), especially when they use malicious scripts and established communication channels with the management and control infrastructure (C2) to move laterally within the network and advance the attack.
Malicious objects used for initial infection
In Q2 2025, the percentage of ICS computers on which denylisted internet resources were blocked increased to 5.91%.
Percentage of ICS computers on which denylisted internet resources were blocked, Q2 2022–Q2 2025
The percentage of ICS computers on which denylisted internet resources were blocked ranged from 3.28% in East Asia to 6.98% in Africa. Russia and Eastern Europe were also among the top three regions for this indicator. It increased in all regions and this growth is associated with the addition of direct links to malicious code hosted on popular public websites and file-sharing services.
The percentage of ICS computers on which malicious documents were blocked has grown for two consecutive quarters. The rate reached 1.97% (up 0.12 pp) and returned to the level seen in Q3 2024. The percentage increased in all regions except Latin America.
The percentage of ICS computers on which malicious scripts and phishing pages were blocked decreased to 6.49% (down 0.67 pp).
Next-stage malware
Malicious objects used to initially infect computers deliver next-stage malware (spyware, ransomware, and miners) to victims’ computers. As a rule, the higher the percentage of ICS computers on which the initial infection malware is blocked, the higher the percentage for next-stage malware.
In Q2 2025, the percentage of ICS computers on which malicious objects from all categories were blocked decreased. The rates are:
- Spyware: 3.84% (down 0.36 pp);
- Ransomware: 0.14% (down 0.02 pp);
- Miners in the form of executable files for Windows: 0.63% (down 0.15 pp);
- Web miners: 0.30% (down 0.23 pp), its lowest level since Q2 2022.
Self-propagating malware
Self-propagating malware (worms and viruses) is a category unto itself. Worms and virus-infected files were originally used for initial infection, but as botnet functionality evolved, they took on next-stage characteristics.
To spread across ICS networks, viruses and worms rely on removable media, network folders, infected files including backups, and network attacks on outdated software such as Radmin2.
In Q2 2025, the percentage of ICS computers on which worms and viruses were blocked decreased to 1.22% (down 0.09 pp) and 1.29% (down 0.24 pp). Both are the lowest values since Q2 2022.
AutoCAD malware
This category of malware can spread in a variety of ways, so it does not belong to a specific group.
In Q2 2025, the percentage of ICS computers on which AutoCAD malware was blocked continued to decrease to 0.29% (down 0.05 pp) and reached its lowest level since Q2 2022.
For more information on industrial threats see the full version of the report.
Qilin Ransomware Colpisce Nel Profondo la Finanza Sudcoreana
Immaginate di svegliarvi una mattina e scoprire che i vostri dati finanziari sensibili – contratti, liste clienti, strategie di investimento – sono esposti su un sito nascosto del dark web, con un timer che minaccia di renderli pubblici se non pagate un riscatto. È esattamente ciò che è accaduto a dieci società di asset management in Corea del Sud, vittime della campagna “Korean Leak” orchestrata dal gruppo ransomware Qilin.
La Campagna “Korean Leak”: Le Dieci Vittime e i Dati Esposti
Attraverso attività di monitoraggio CTI e OSINT — con fonti come Ransomware.live e H4ckmanac — è emerso che il gruppo Qilin ha preso di mira il settore sudcoreano dell’asset management. La verifica diretta sul loro sito onion ha confermato la pubblicazione, in data 14/09, delle schede dedicate alle vittime identificate come Korean Leak, corredate da campioni di dati esfiltrati. Di seguito le dieci organizzazioni colpite, sulla base di rivendicazioni verificate e IOC estratti dal Data Leak Site (DLS):
- Human & Bridge Asset Management: Rivendicazione con sample di report finanziari e liste clienti; IOC include FTP endpoint per exfiltrazione
- Vanchor Asset Management: Pubblicati dettagli su portafogli investitori; MD5 hash associati a file leakati.
- Klarman Asset Management: Scheda con screenshot di documenti interni; IP tracciati per comando e controllo.
- Taurus Investment & Securities Co: Esposti dati HR e partnership; tool di esfiltrazione come WinSCP identificati nei log.
- Apex Asset Management: Leak di analisi rischio; hash file.
- LX Asset Management: Pubblicati budget e proiezioni; IOC include Proxychains per networking.
- Majesty Asset Management Co: Dati compliance e contabili; evasion tools come EDRSandBlast menzionati.
- Melon Asset Management Co: Liste investitori esfiltrate; credential theft via Mimikatz.
- Pollex Asset Management Co: Analisi M&A interne; IP C2.
- Awesome Asset Management Co: Piani marketing e anagrafiche; exfiltration tramite EasyUpload.io.
Queste rivendicazioni, mostrano un pattern di pubblicazione progressiva: preview iniziali seguiti da full dump se il riscatto non è pagato.
L’Origine di Qilin: Da Mitologia a Minaccia Cibernetica
Qilin non è solo un nome: deriva da una creatura mitologica cinese simbolo di cambiamenti epocali, e il gruppo lo usa per rivendicare una missione che va oltre il profitto criminale. Come emerge dall’intervista esclusiva di Red Hot Cyber, Qilin si presenta come sostenitore di un “mondo multipolare”, con toni anti-occidentali e una struttura decentralizzata che coinvolge team in molteplici paesi. Ma dietro la retorica, c’è un’operazione RaaS (Ransomware-as-a-Service) sofisticata, con payload in Rust e C sviluppati internamente per evadere le difese.
Il gruppo è attivo dal 2022 e ha scalato le classifiche delle minacce: solo ad aprile 2025 ha rivendicato 72 vittime, inclusa l’ondata sudcoreana. La loro infrastruttura include un Data Leak Site (DLS) su Tor, noto come “WikiLeaks V2”, accessibile via onion address come ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion, dove pubblicano dati per pressione estorsiva.
Come Funziona l’Attacco: Tattiche e Tool Rivendicati
Dall’intervista di Red Hot Cyber, Qilin rivela di usare “tutto”: phishing, exploit 0-day/1-day ricercati internamente, e permanenza prolungata nelle reti per studiare processi prima della cifratura. Il loro stack include:
- Discovery: Nmap, Nping per mappatura reti.
- RMM Tools: ScreenConnect per accesso remoto.
- Defense Evasion: EDRSandBlast, PowerTool, driver come Toshiba power management per BYOVD.
- Credential Theft: Mimikatz per estrazione credenziali.
- OffSec: Cobalt Strike, Evilginx, NetExec per esecuzione avanzata.
- Networking: Proxychains per anonimizazione.
- LOLBAS: fsutil, PsExec, WinRM per abuso di tool legittimi.
- Exfiltration: EasyUpload.io per upload dati.
IOC specifici estratti includono IP C2 come 176.113.115.97 e numerosi MD5 hash di payload, confermando l’uso di FTP per trasferimento dati sottratti.
Il Modello di Business: RaaS e Pressione Legale
Qilin opera come RaaS con split 80/20 (affiliati/servizio), e parte dei ricavi è dichiarata destinata a “movimenti per la libertà”. La “doppia estorsione” è evoluta: oltre alla cifratura, minacciano aste, vendita a concorrenti o pubblicazione totale. Offrono persino “immunità” preventiva a pagamento, paragonata a un “vaccino”
Nel 2025, hanno aggiunto il “pacchetto intimidazione”: team legali e giornalisti interni per negoziazioni e campagne mediatiche, con 1 PB di storage e tool DDoS integrati. Qilin non è solo codice: è una minaccia ibrida che mescola crimine, ideologia e innovazione. Capirla è il primo passo per contrastarla.
L'articolo Qilin Ransomware Colpisce Nel Profondo la Finanza Sudcoreana proviene da il blog della sicurezza informatica.
Dirty Pots, Meet Power Tools!
Let’s face it, nobody likes scrubbing, but what option do you have? You can’t exactly break out the grinder to clean off the remains of last nights dinner… right? Well, maybe not a grinder, but thanks to this hack by [Markus Opitz], you can use an oscillating tool.
It’s a simple enough hack: [Markus] modeled the attachment for his Bosch oscillating tool in Tinkercad, and created a bracket to hold a large metal binder clip. The clip attaches with a screw, and can hold whatever scrubbing pad your carpel-tunnel afflicted hands can’t bear to hold on to. He’s using a self-cleaning stainless-steel sponge.
One nice touch is a pair of protective lips on the jaws of the metal clip, to keep it from accidentally scratching the delicate surface under care. Of course if you have a drill or a Dremel handy you can buy attachments for polishing disks of various grits, but what’s the fun in that? Doing the dishes with a hacked-together oscillating tool just somehow seems more fun. Plus this way you can’t accidentally produce an engine-turning pattern.
We don’t seem to have featured many hacks for these fun, buzzing, multi-purpose tools, so if you’ve got one send us a tip. We did feature an oscillating cutter for CNC once, but that was fully DIY.
Pronti per il Blocco Note con l’AI? Presto su Windows 11 con PC Copilot+!
Gli utenti Windows 11 con PC Copilot+ potranno usufruire di funzionalità avanzate di intelligenza artificiale, ormai parte integrante dell’applicazione Blocco note, grazie ad un aggiornamento che include potenti strumenti per la creazione e la modifica del testo. Tra le nuove funzionalità ci sono “Riepiloga”, “Scrivi” e “Riscrivi”, utilizzabili senza necessità di sottoscrivere un abbonamento, direttamente sul dispositivo.
Gli strumenti innovativi basati sull’intelligenza artificiale, integrati in Blocco note, consentono agli utenti di creare, ottimizzare e sintetizzare il testo in modo efficiente. Funzionando direttamente sulla Neural Processing Unit (NPU) dei PC Copilot+, questi strumenti operano in locale, permettendo un utilizzo offline senza necessità di un abbonamento a Microsoft 365 o di accesso a un account Microsoft.
Un elemento cruciale di questo aggiornamento riguarda il cambio di strategia verso un modello di intelligenza artificiale incorporato direttamente nel dispositivo. Ciò consente una maggiore accessibilità a funzionalità avanzate di supporto alla scrittura. In passato, le capacità di intelligenza artificiale integrate in Blocco note dipendevano dall’elaborazione cloud e richiedevano sottoscrizioni a Microsoft 365, che mettevano a disposizione un quantitativo prestabilito di crediti di intelligenza artificiale. Adesso, grazie a PC Copilot+, gli utenti possono usufruire gratuitamente e senza restrizioni di tali funzionalità.
Gli utenti che sottoscrivono un abbonamento a Microsoft365 possono beneficiare di un sistema più versatile. A seconda delle loro necessità, è possibile passare agevolmente dalla versione gratuita, integrata nel dispositivo, alla versione avanzata basata sul cloud. Questo modello ibrido fa sì che gli strumenti di intelligenza artificiale di alta qualità siano accessibili a un’utenza più vasta, pur mantenendo disponibili funzionalità avanzate per chi ha sottoscritto l’abbonamento. Inizialmente, il lancio di queste funzioni sarà limitato a contenuti in lingua inglese.
Un’innovazione sostanziale caratterizza l’editor di testo classico con l’introduzione dell’intelligenza artificiale. Grazie alla funzione “Riscrivi”, è possibile adeguare il tono, il formato e la lunghezza di contenuti già esistenti, mentre la funzione “Scrivi” permette agli utenti di produrre nuovo testo partendo da un semplice suggerimento. Inoltre, con “Riepiloga”, gli utenti possono velocemente sintetizzare documenti estesi in resoconti compatti.
Questo aggiornamento segue una serie di recenti miglioramenti al Blocco Note, tra cui l’aggiunta di tabulazioni, un contatore di caratteri, il controllo ortografico e la correzione automatica, trasformandolo in un editor più completo. Gli utenti che preferiscono l’esperienza classica e senza fronzoli avranno la possibilità di disattivare le nuove funzionalità di intelligenza artificiale nelle impostazioni dell’app.
La nuova versione di Notepad (11.2508.28.0) è attualmente in fase di distribuzione per i Windows Insider nei canali Canary e Dev e si prevede che sarà disponibile per tutti gli utenti di Windows 11 con hardware compatibile nelle prossime settimane.
L'articolo Pronti per il Blocco Note con l’AI? Presto su Windows 11 con PC Copilot+! proviene da il blog della sicurezza informatica.
A GEM Of A Desktop Environment
Desktop environments are the norm as computer interfaces these days, but there was once a time when they were a futuristic novelty whose mere presence on a computer marked it out as something special. In the early 1980s you could buy an expensive but very fancy Mac from Apple, while on the PC there were early Windows versions, and GEM from Digital Research. It’s something of a footnote here in 2025, and some insight as to why comes from [Programming at the right level] with a retrospective on the software.
Coming from the perspective of an Atari user whose ST shipped with a version of GEM, it tracks the projects from its earliest roots with a Xerox employee, through development to launch on the PC and Atari ST. We learn about an Apple legal threat that resulted in the hobbled interface many of us remember from later GEM versions, and about the twists and turns in its path before the final dissolution of DR in the early 1990s.
From 2025 it’s clear that Windows won the PC desktop battle not by being special but by being the default; when GEM was an add-on extra it would have been a tough sell. The software was eventually made open-source by the eventual owner of the DR assets, Caldera (when they weren’t trying to torpedo Linux, presumably), and can be run today on FreeDOS.
GEM header image: Rolf Hartmann, CC BY-SA 3.0.
A Deep Dive on Creepy Cameras
George Orwell might’ve predicted the surveillance state, but it’s still surprising how many entities took 1984 as a how-to manual instead of a cautionary tale. [Benn Jordan] decided to take a closer look at the creepy cameras invading our public spaces and how to circumvent them.
[Jordan] starts us off with an overview of how machine learning “AI” is used Automated License Plate Reader (ALPR) cameras and some of the history behind their usage in the United States. Basically, when you drive by one of these cameras, an ” image segmentation model or something similar” detects the license plate and then runs optical character recognition (OCR) on the plate contents. It will also catalog any bumper stickers with the make and model of the car for a pretty good guess of it being your vehicle, even if the OCR isn’t 100% on the exact plate sequence.
Where the video gets really interesting is when [Jordan] starts disassembling, building, and designing countermeasures to these systems. We get a teardown of a Motorola ALPR for in-vehicle use that is better at being closed hardware than it is at reading license plates, and [Jordan] uses a Raspberry Pi 5, a Halo AI board, and You Only Look Once (YOLO) recognition software to build a “computer vision system that’s much more accurate than anything on the market for law enforcement” for $250.
[Jordan] was able to develop a transparent sticker that renders a license plate unreadable to the ALPR but still plainly visible to a human observer. What’s interesting is that depending on the pattern, the system could read it as either an incorrect alphanumeric sequence or miss detecting the license plate entirely. It turns out, filtering all the rectangles in the world to find just license plates is a tricky problem if you’re a computer. You can find the code on his Github, if you want to take a gander.
You’ve probably heard about using IR LEDs to confuse security cameras, but what about yarn? If you’re looking for more artistic uses for AI image processing, how about this camera that only takes nudes or this one that generates a picture based on geographic data?
youtube.com/embed/Pp9MwZkHiMQ?…
Enhanced Definition TV: “A Poor Man’s High-Def”
Although to many of us the progression from ‘standard definition’ TV and various levels of high-definition at 720p or better seemed to happen smoothly around the turn of the new century, there was a far messier technological battle that led up to this. One of these contenders was Enhanced Definition TV (EDTV), which was 480p in either 4:3 or 16:9, as a step up from Standard Definition TV (SDTV) traditional TV quality. The convoluted history of EDTV and the long transition to proper HDTV is the subject of a recent video by [VWestlife].
One reason why many people aren’t aware of EDTV is because of marketing. With HDTV being the hot new bullet point to slap on a product, a TV being widescreen was often enough to market an EDTV with 480p as ‘HD’, not to mention the ‘HD-compatible’ bullet point that you could see everywhere.
That said, the support for digital 480p and ‘simplified 1080i’ signals of EDTV makes these displays still quite usable today, more than SDTV CRTs and LCDs that are usually limited to analog signals-only at regular NTSC, PAL or SECAM. It may not be HD, but at least it’s enhanced.
youtube.com/embed/J0as4DiswGU?…
Worst Clock Ever Teaches You QR Codes
[WhiskeyTangoHotel] wrote in with his newest clock build — and he did warn us that it was minimalist and maybe less than useful. Indeed, it is nothing more than a super-cheap ESP32-C3 breakout board with an OLED screen and some code. Worse, you can’t even tell the time on it without pointing your cell phone at the QR code it generates. Plot twist: you skip the QR code and check the time on your phone.
But then we got to thinking, and there is actually a lot to learn from here on the software side. This thing pulls the time down from an NTP server, formats it into a nice human-readable string using strftime, throws that string into a QR code that’s generated on the fly, and then pushes the bits out to the screen. All in a handful of lines of code.
As always, the secret is in the libraries and how you use them, and we wanted to check out the QR code generator, but we couldn’t find an exact match for QRCodeGenerator.h. Probably the most popular library is the Arduino QRCode library by [ricmoo]. It’s bundled with Arduino, but labelled version 0.0.1, which we find a little bit modest given how widely it’s used. It also hasn’t been updated in eight years: proof that it just works?
That library drew from [nayuki]’s fantastically documented multi-language QR-Code-generator library, which should have you covered on any platform you can imagine, with additional third-party ports to languages you haven’t even heard of. That’s where we’d go for a non-Arduino project.
What library did [WTH] use? We hope to find out soon, but at least we found a couple good candidates, and it appears to be a version of one or the other.
We’ve seen a lot of projects where the hacker generates a QR code using some online tool, packs the bits into a C header array, and displays that. That’s fine when you only need a single static QR code, but absolutely limiting when you want to make something dynamic. You know, like an unreadable clock.
You will not be surprised to know that this isn’t the first unreadable QR-code clock we’ve featured here. But it’s definitely the smallest and most instructive.
youtube.com/embed/rA7HXQxqpPA?…
Radio Apocalypse: Clearing the Air with SCATANA
For the most part, the Radio Apocalypse series has focused on the radio systems developed during the early days of the atomic age to ensure that Armageddon would be as orderly an affair as possible. From systems that provided backup methods to ensure that launch orders would reach the bombers and missiles, to providing hardened communications systems to allow survivors to coordinate relief and start rebuilding civilization from the ashes, a lot of effort went into getting messages sent.
Strangely, though, the architects of the end of the world put just as much thought into making sure messages didn’t get sent. The electronic village of mid-century America was abuzz with signals, any of which could be abused by enemy forces. CONELRAD, which aimed to prevent enemy bombers from using civilian broadcast signals as navigation aids, is a perfect example of this. But the growth of civil aviation through the period presented a unique challenge, particularly with the radio navigation system built specifically to make air travel as safe and reliable as possible.
Balancing the needs of civil aviation against the possibility that the very infrastructure making it possible could be used as a weapon against the U.S. homeland is the purpose of a plan called Security Control of Air Traffic and Air Navigation Aids, or SCATANA. It’s a plan that cuts across jurisdictions, bringing military, aviation, and communications authorities into the loop for decisions regarding when and how to shut down the entire air traffic system, to sort friend from foe, to give the military room to work, and, perhaps most importantly, to keep enemy aircraft as blind as possible.
Highways in the Sky
As its name suggests, SCATANA has two primary objectives: to restrict the availability of radio navigation aids during emergencies and to clear the airspace over the United States of unauthorized traffic. For safety’s sake, the latter naturally follows the former. By the time the SCATANA rules were promulgated, commercial aviation had become almost entirely dependent on a complex array of beacons and other radio navigation aids. While shutting those aids down to deny their use to enemy bombers was obviously the priority, safety demanded that all the planes currently using those aids had to be grounded as quickly as possible.
Understanding the logic behind SCATANA requires at least a basic insight into these radio navigation aids. The Federal Communications Commission (FCC) has jurisdiction over these aids, listing “VOR/DME, ILS, MLS, LF and HF non-directional beacons” as subject to shutdown in times of emergency. That’s quite a list, and while the technical details of the others are interesting, particularly the Adcock LF beacon system used by pilots to maneuver onto a course until alternating “A” and “N” Morse characters merged into a single tone, but for practical purposes, the one with the most impact on wartime security is the VOR system.
VOR, which stands for “VHF omnidirectional range,” is a global system of short-range beacons used by aircraft to determine their direction of travel. The system dates back to the late 1940s and was extensively built out during the post-war boom in commercial aviation. VOR stations define the “highways in the air” that criss-cross the country; if you’ve ever wondered why the contrails of jet airliners all follow similar paths and why the planes make turns at more or less the same seemingly random point in the sky, it’s because they’re using VOR beacons as waypoints.
In its simplest form, a VOR station consists of an omnidirectional antenna transmitting at an assigned frequency between 108 MHz and 117.95 MHz, hence the “VHF” designation. The frequency of each VOR station is noted on the sectional charts pilots use for navigation, along with the three-letter station identifier, which is transmitted by the station in Morse so pilots can verify which station their cockpit VOR equipment is tuned to.
Each VOR station encodes azimuth information by the phase difference between two synchronized 30 Hz signals modulated onto the carrier, a reference signal and a variable signal. In conventional VOR, the amplitude-modulated variable signal is generated by a rotating directional antenna transmitting a signal in-phase with the reference signal. By aligning the reference signal with magnetic north, the phase angle between the FM reference and AM variable signals corresponds to the compass angle of the aircraft relative to the VOR station.
youtube.com/embed/R0Vzaf14SKQ?…
More modern Doppler VORs, or DVORs, use a ring of antennas to electronically create the reference and variable signals, rather than mechanically rotating the antenna. VOR stations are often colocated with other radio navigation aids, such as distance measuring equipment (DME), which measures the propagation delay between the ground station and the aircraft to determine the distance between them, or TACAN, a tactical air navigation system first developed by the military to provide bearing and distance information. When a VOR and TACAN stations are colocated, the station is referred to as a VORTAC.
Shutting It All Down
At its peak, the VOR network around the United States numbered almost 1,000 stations. That number is on the decrease now, thanks to the FAA’s Minimum Operational Network plan, which seeks to retire all but 580 VOR stations in favor of cockpit GPS receivers. But any number of stations sweeping out fully analog, unencrypted signals on well-known frequencies would be a bonanza of navigational information to enemy airplanes, which is why the SCATANA plan provides specific procedures to be followed to shut the whole thing down.
SCATANA is designed to address two types of emergencies. The first is a Defense Emergency, which is an outright attack on the United States homeland, overseas forces, or allied forces. The second is an Air Defense Emergency, which is an aircraft or missile attack on the continental U.S., Canada, Alaska, or U.S. military installations in Greenland — sorry, Hawaii. In either case, the attack can be in progress, imminent, or even just probable, as determined by high-ranking military commanders.
In both of those situations, military commanders will pass the SCATANA order to the FAA’s network of 22 Air Route Traffic Control Centers (ARTCC), the facilities that handle traffic on the routes defined by VOR stations. The SCATANA order can apply to all of the ARTCCs or to just a subset, depending on the scale of the emergency. Each of the concerned centers will then initiate physical control of their airspace, ordering all aircraft to land at the nearest available appropriate airport. Simultaneously, if ordered by military authority, the navigational aids within each ARTCC’s region will be shut down. Sufficient time is obviously needed to get planes safely to the ground; SCATANA plans allow for this, of course, but the goal is to shut down navaids as quickly as possible, to deny enemy aircraft or missiles any benefit from them.
As for the specific instructions for shutting down navigational aids, the SCATANA plan is understandable mute on this subject. It would not be advisable to have such instructions readily available, but there are a few crumbs of information available in the form of manuals and publicly accessible documents. Like most pieces of critical infrastructure these days, navaid ground stations tend to be equipped with remote control and monitoring equipment. This allows maintenance technicians quick and easy access without the need to travel. Techs can perform simple tasks, such as switching over from a defective primary transmitter to a backup, to maintain continuity of service while arrangements are made for a site visit. Given these facts, along with the obvious time-critical nature of an enemy attack, SCATANA-madated navaid shutdowns are probably as simple as a tech logging into the ground station remotely and issuing a few console commands.
A Day to Remember
For as long as SCATANA has been in effect — the earliest reference I could find to the plan under that name dates to 1968, but the essential elements of the plan seem to date back at least another 20 years — it has only been used in anger once, and even then only partially. That was on that fateful Tuesday, September 11, 2001, when a perfect crystal-blue sky was transformed into a battlefield over America.
By 9:25 AM Eastern, the Twin Towers had both been attacked, American Airlines Flight 77 had already been hijacked and was on its way to the Pentagon, and the battle for United Flight 93 was unfolding above Ohio. Aware of the scope of the disaster, staff at the FAA command center in Herndon, Virginia, asked FAA headquarters if they wanted to issue a “nationwide ground stop” order. While FAA brass discussed the matter, Ben Sliney, who had just started his first day on the job as operations manager at the FAA command center, made the fateful decision to implement the ground stop part of the SCATANA plan, without ordering the shutdown of navaids.
The “ground stop” orders went out to the 22 ARTCCs, which began the process of getting about 4,200 in-flight aircraft onto the ground as quickly and safely as possible. The ground stop was achieved within about two hours without any further incidents. The skies above the country would remain empty of civilian planes for the next two days, creating an eerie silence that emphasized just how much aviation contributes to the background noise of modern life.
youtube.com/embed/bo1ZtpKqlYw?…
PCBs the Prehistoric Way
When we see an extremely DIY project, you always get someone who jokes “well, you didn’t collect sand and grow your own silicon”. [Patrícia J. Reis] and [Stefanie Wuschitz] did the next best thing: they collected local soil, sieved it down, and fired their own clay PCB substrates over a campfire. They even built up a portable lab-in-a-backpack so they could go from dirt to blinky in the woods with just what they carried on their back.
This project is half art, half extreme DIY practice, and half environmental consciousness. (There’s overlap.) And the clay PCB is just part of the equation. In an effort to approach zero-impact electronics, they pulled ATmega328s out of broken Arduino boards, and otherwise “urban mined” everything else they could: desoldering components from the junk bin along the way.
The traces themselves turned out to be the tricky bit. They are embossed with a 3D print into the clay and then filled with silver before firing. The pair experimented with a variety of the obvious metals, and silver was the only candidate that was both conductive and could be soldered to after firing. Where did they get the silver dust? They bought silver paint from a local supplier who makes it out of waste dust from a jewelry factory. We suppose they could have sat around the campfire with some old silver spoons and a file, but you have to draw the line somewhere. These are clay PCBs, people!
Is this practical? Nope! It’s an experiment to see how far they can take the idea of the pre-industrial, or maybe post-apocalyptic, Arduino. [Patrícia] mentions that the firing is particularly unreliable, and variations in thickness and firing temperature lead to many cracks. It’s an art that takes experience to master.
We actually got to see the working demos in the flesh, and can confirm that they did indeed blink! Plus, they look super cool. The video from their talk is heavy on theory, but we love the practice.
DIY clay PCBs make our own toner transfer techniques look like something out of the Jetsons.
media.ccc.de/v/38c3-clay-pcb/o…
Il RE di RaidForums resta in bilico. La battaglia tra USA e Portogallo per la sua estradizione
L’Alta Corte di Londra ha annullato la decisione di estradare il cittadino portoghese Diogo Santos Coelho negli Stati Uniti. Il giovane, noto con lo pseudonimo di Omnipotent, era l’amministratore di uno dei più grandi forum di hacker, RaidForums.
La storia inizia nel gennaio 2022, quando Coelho si reca nel Regno Unito per far visita alla madre. Lì viene arrestato. Da allora, è in un limbo da più di tre anni: due Paesi si contendono la sua estradizione.
Gli Stati Uniti chiedono l’estradizione di Coelho per crimini legati alla gestione di RaidForums. Il Portogallo ha inviato un proprio ordine, citando i danni arrecati alle sue organizzazioni e ai suoi cittadini.
Lo stesso Coelho voleva recarsi in Portogallo e ha ufficialmente accettato l’estradizione.
Le autorità britanniche si sono trovate in una situazione difficile. La legge prevede una procedura speciale nel caso in cui più paesi richiedano l’estradizione di una persona. Ma nel suo caso queste regole non sono state rispettate.
Il Ministro dell’Interno ordinò che Coelho fosse trasferito negli Stati Uniti, ma lo fece frettolosamente. Il tribunale stabilì che la decisione si basava su documenti inesatti e che era stata presa senza tenere conto della posizione della difesa.
Il problema principale era che a Coelho non fu data l’opportunità di presentare le sue argomentazioni per l’estradizione in Portogallo. Le sue argomentazioni non furono nemmeno prese in considerazione.
Il giudice Linden ha riscontrato diverse violazioni. Secondo l’ordinanza del tribunale, al ministro è stato detto che le accuse statunitensi e portoghesi erano “identiche”, sebbene l’ordinanza portoghese includesse ulteriori accuse di riciclaggio di denaro e frode fiscale.
Inoltre, la decisione si basava sul presupposto che tutte le vittime si trovassero negli Stati Uniti. Ma le prove dimostravano il contrario: le vittime erano sparse in tutto il mondo, compreso il Portogallo stesso.
La corte ha inoltre affermato che il ministro non ha tenuto conto della natura più grave delle accuse portoghesi e dei legami personali di Coelho con il Paese. Gli è stato diagnosticato l’autismo, è a rischio di suicidio e riceve assistenza familiare e terapeutica nel suo Paese d’origine.
Il Ministero dell’Interno è ora tenuto a riesaminare le richieste concorrenti. A Coelho è stato concesso il diritto di presentare le sue argomentazioni prima che venga presa una nuova decisione.
Come ha osservato lo stesso Coelho, questo non garantisce l’estradizione in Portogallo, ma dà ai suoi avvocati la possibilità di essere ascoltati. Tra le argomentazioni della difesa c’è il fatto che alcuni dei presunti crimini siano stati commessi quando era minorenne, nonché il suo status di vittima della tratta di esseri umani.
L'articolo Il RE di RaidForums resta in bilico. La battaglia tra USA e Portogallo per la sua estradizione proviene da il blog della sicurezza informatica.
A New Generation of Spacecraft Head to the ISS
While many in the industry were at first skeptical of NASA’s goal to put resupply flights to the International Space Station in the hands of commercial operators, the results speak for themselves. Since 2012, the SpaceX Dragon family of spacecraft has been transporting crew and cargo from American soil to the orbiting laboratory, a capability that the space agency had lost with the retirement of the Space Shuttle. Putting these relatively routine missions in the hands of a commercial provider like SpaceX takes some of the logistical and financial burden off of NASA, allowing them to focus on more forward-looking projects.
But as the saying goes, you should never put all of your eggs in one basket. As successful as SpaceX has been, there’s always a chance that some issue could temporarily ground either the Falcon 9 or the Dragon.
While Russia’s Progress and Soyuz vehicles would still be available in an emergency situation, it’s in everyone’s best interest that there be multiple backup vehicles that can bring critical supplies to the Station.
Which is precisely why several new or upgraded spacecraft, designed specifically for performing resupply missions to the ISS and any potential commercial successor, are coming online over the next few years.
In fact, one of them is already flying its first mission, and will likely have arrived at the International Space Station by the time you read this article.
Cygnus XL
The Cygnus was the second commercial spacecraft to deliver cargo to the ISS back in 2013, and like the Dragon, has gone through several upgrades and revisions over the years. Rather than starting from a clean slate, the Orbital Sciences Corporation based the vehicle’s pressurized module on the Multi-Purpose Logistics Module which was originally designed to fly inside the Space Shuttle’s cargo bay to provide onboard laboratory space before the construction of the ISS. This was paired with a service module that was derived from their line of communication satellites.
It retains the same 3.07 m (10.1 ft) diameter of the original Cygnus, but the length of the vehicle has been increased from 5.14 m (16.9 ft) to 8 m (26 ft). This has nearly doubled the internal pressurized volume of the craft, and the payload capacity has been increased from 2,000 kg (4,400 lb) to 5,000 kg (11,000 lb).
While the Dragon can autonomously dock with the ISS, the Cygnus XL needs to be captured by an astronaut using the Station’s robotic arm, and manually moved into position where it’s eventually bolted into place — a process known as berthing. This is a more labor intensive method of connecting a visiting spacecraft, but it does have at least one advantage, as the diameter of the berthing ports is larger than that of the docking ports. At least in theory, this means Cygnus XL would be able to deliver bulkier objects to the Station than the Dragon or any other spacecraft that makes use of the standard docking ports.
Like the earlier versions of the craft, Cygnus XL is an expendable vehicle, and lacks the heat shield that would be necessary to reenter Earth’s atmosphere safely. Once the vehicle delivers its cargo and is detached from the Station, it’s commanded to perform a deorbit maneuver which will cause it to burn up in the atmosphere. But even this serves an important function, as the astronauts will load the vehicle with trash before it departs, ensuring that refuse from the Station is destroyed in a safe and predictable manner.
HTV-X
Like the Cygnus XL, the HTV-X is an upgraded version of a spacecraft which has already visited the ISS, namely the H-II Transfer Vehicle (HTV). Designed and built by the Japan Aerospace Exploration Agency (JAXA), the first flight of this upgraded cargo vehicle is tentatively scheduled for late October.
Attached to the opposite side of the service module is an unpressurized cargo module. This is similar to the “trunk” of the Dragon spacecraft, in that it’s essentially just a hollow cylinder with shelves and mounting points inside. This module could potentially be used to bring up components that are intended to be attached to the outside of the ISS, or it could hold experiments and modules that are designed to be exposed to the space environment.
Like the Cgynus XL, the HTV-X will berth to the ISS rather than dock, and it will also burn up after its mission is complete. However the HTV-X is designed to fly freely on its own for up to 18 months after it delivers its cargo to the Station, which JAXA calls the “Technology Demonstration Phase” of the mission. This will essentially allow the agency to perform a second mission after the vehicle has completed its supply run, greatly improving the overall cost effectiveness of the program.
Dream Chaser
Far and away the most ambitious of these new spacecraft is the Dream Chaser, developed by Sierra Space. Reminiscent of a miniature version of the Space Shuttle, this winged vehicle is designed to land like an airplane at the end of its mission. This not only means it can bring material back down to Earth at the end of its mission, but that it can do so in a much less jarring manner than a capsule that ends up splashing down into the ocean under parachutes. This is a huge benefit when dealing with fragile cargo or scientific experiments, and is a capability not offered by any other currently operational spacecraft.
The Dream Chaser has been in active development for over 20 years, but its origins date back even farther than that, as it’s based on HL-20 Personnel Launch System concept from the 1980s. While it was initially designed for crew transport, it lost out to SpaceX and Boeing during NASA’s Commercial Crew Program selection in 2014. It did however secure a contract from the space agency in 2016 for six cargo missions to the ISS. To qualify for these missions, several changes were made to the original design, such as the addition of an expendable module that will attach to the rear of the vehicle to increase its relatively limited internal cargo capacity of 910 kg (2,000 lb) by 4,500 kg (10,000 lb).
The first orbital test flight of the Dream Chaser is currently scheduled to take place before the end of the year, but that date has already slipped several times. Being a reusable vehicle like the Dragon, the first Dream Chaser spaceplane is expected to fly multiple operational missions while a second craft is being assembled.
After completing their contractually obligated missions to the ISS, there are currently plans for the Dream Chaser to fly at least one mission for the United Nations Office for Outer Space Affairs, which will carry an array of scientific experiments provided by member nations that do not have their own domestic space programs. The company also says they remain committed to bringing the crewed version of Dream Chaser to fruition, likely as part of their partnership with Blue Origin to develop the Orbital Reef — a “mixed-use business park” in space.
Time is Running Out
It might seem strange that three different spacecraft are scheduled to enter service before the end of the year, but of course, the clock is ticking. Although the date has been pushed out a number of times over the years, the current 2030 timeline for the decommissioning of the International Space Station seems to be holding so far. With as little as five years left to go before the ISS joins us Earthlings back here on the surface, it’s now or never for any vehicles designed for service missions. This is doubly true for companies such as Sierra Space, who have already agreed to perform a set number of missions.
At the same time, any of these vehicles could support a future commercial space station, should one actually materialize. We’ve covered some of the post-ISS plans previously, but given how volatile the aerospace world is, nothing is a given until it’s actually in orbit.
Listening for the Next Wow! Signal with Low-Cost SDR
As you might expect, the University of Puerto Rico at Arecibo has a fascination with radio signals from space. While doing research into the legendary “Wow! Signal” detected back in 1977, they realized that the burst was so strong that a small DIY radio telescope would be able to pick it up using modern software-defined radio (SDR) technology.
This realization gave birth to the Wow@Home project, an effort to document both the hardware and software necessary to pick up a Wow! class signal from your own backyard. The University reasons that if they can get a bunch of volunteers to build and operate these radio telescopes, the resulting data could help identify the source of the Wow! Signal — which they believe could be the result of some rare astrophysical event and not the product of Little Green Men.
Ultimately, this isn’t much different from many of the SDR-based homebrew radio telescopes we’ve covered over the years — get a dish, hook your RTL-SDR up to it, add in the appropriate filters and amplifiers, and point it to the sky. Technically, you’re now a radio astronomer. Congratulations. In this case, you don’t even have to figure out how to motorize your dish, as they recommend just pointing the antenna at a fixed position and let the rotation of the Earth to the work — a similar trick to how the legendary Arecibo Observatory itself worked.
The tricky part is collecting and analyzing what’s coming out of the receiver, and that’s where the team at Arecibo hope to make the most headway with their Wow@Home software. It also sounds like that’s where the work still needs to be done. The goal is to have a finished product in Python that can be deployed on the Raspberry Pi, which as an added bonus will “generate a live preview of the data in the style of the original Ohio State SETI project printouts.” Sounds cool to us.
If you’re interested in lending a hand, the team says they’re open to contributions from the community — specifically from those with experience RFI shielding, software GUIs, and general software development. We love seeing citizen science, so hopefully this project finds the assistance and the community it needs to flourish.
Thanks to [Mark Stevens] for the tip.
BMW nel mirino: Everest Ransomware minaccia la pubblicazione di dati critici
La cybergang Everest, nota per il suo approccio aggressivo al cybercrime, ha reso pubblica sul suo DLS (Data Leak Site) una presunta violazione che coinvolge BMW.
Il post pubblicato mostra che i documenti critici dell’audit BMW saranno accessibili online tra poche ore, mentre altri dettagli importanti rimarranno disponibili per poco più di un giorno.
Disclaimer: Questo rapporto include screenshot e/o testo tratti da fonti pubblicamente accessibili. Le informazioni fornite hanno esclusivamente finalità di intelligence sulle minacce e di sensibilizzazione sui rischi di cybersecurity. Red Hot Cyber condanna qualsiasi accesso non autorizzato, diffusione impropria o utilizzo illecito di tali dati. Al momento, non è possibile verificare in modo indipendente l’autenticità delle informazioni riportate, poiché l’organizzazione coinvolta non ha ancora rilasciato un comunicato ufficiale sul proprio sito web. Di conseguenza, questo articolo deve essere considerato esclusivamente a scopo informativo e di intelligence.
Everest, attiva da diversi anni nel panorama del cybercrime internazionale, ha già colpito in passato grandi enti e aziende. Tra i loro attacchi più noti si ricorda quello alla SIAE, dove furono sottratti dati sensibili relativi alla gestione dei diritti d’autore italiani.
Negli ultimi sette giorni, il DLS di Everest ha pubblicato dati di tre aziende italiane, confermando la sua crescente attività sul territorio nazionale. Secondo l’immagine trapelata, i documenti BMW saranno disponibili fino al 14 settembre 2025, con una prima parte dei file accessibile tra circa 4 ore e 47 minuti, mentre ulteriori documenti saranno visibili tra 1 giorno e 13 ore.
La nuova struttura del DLS di Everest rende più immediata la visualizzazione dei countdown e il monitoraggio delle pubblicazioni, aumentando la pressione sulle aziende colpite affinché intervengano rapidamente. Questo episodio conferma come la cybergang stia consolidando la propria reputazione nel settore della cyber extortion e delle fughe di dati sensibili.
Come nostra consuetudine, lasciamo sempre spazio ad una dichiarazione dell’organizzazione qualora voglia darci degli aggiornamenti su questa vicenda e saremo lieti di pubblicarla con uno specifico articolo dando risalto alla questione. RHC monitorerà l’evoluzione della vicenda in modo da pubblicare ulteriori news sul blog, qualora ci fossero novità sostanziali.
L'articolo BMW nel mirino: Everest Ransomware minaccia la pubblicazione di dati critici proviene da il blog della sicurezza informatica.
Italia sotto attacco DDoS da parte dei filorussi di NoName057(16)? Pochi disservizi
Gli hacker di NoName057(16), da qualche giorno hanno riavviato le loro attività ostili contro diversi obiettivi italiani, attraverso attacchi di Distributed Denial-of-Service (DDoS).
Sulla base di quanto osservato, le infrastrutture italiane hanno rafforzato la loro struttura e il periodo di interruzione del servizio è in forte diminuzione rispetto a 2 anni fa, fino quasi ad azzerarsi, grazie all’attuazione di misure contro gli attacchi DDoS e alla crescente consapevolezza che tali attacchi hanno comportato inevitabilmente.
Di seguito gli obiettivi rivendicati nella giornata di oggi dal gruppo di hacktivisti:
- Ministero della Difesa italiano (non risponde al ping) check-host.net/check-report/2e38b31bka1
- Marina Militare Italiana (non risponde al ping) check-host.net/check-report/2e38b4cakf13
- Direzione del sistema portuale del Tirreno centro-settentrionale check-host.net/check-report/2e38bc40k98a
- Azienda italiana per l’energia (non risponde al ping) check-host.net/check-report/2e38be92kd4
- Amministrazione del sistema portuale del Mar Tirreno settentrionale check-host.net/check-report/2e38fbbdk74d
- Ministero del Lavoro e delle Politiche Sociali check-host.net/check-report/2e38ce5ckdc5
- Amministrazione del sistema portuale dei porti dell’Adriatico orientale Trieste e Monfalcone check-host.net/check-report/2e38cfb7k174
- Associazione dei porti di Genova check-host.net/check-report/2e38cfcak762
- Amministrazione del sistema portuale check-host.net/check-report/2e38e509kd71
- Acantho Italia check-host.net/check-report/2e38e509kd71
- SPID (Sistema di identificazione e accesso) check-host.net/check-report/2e38e4e9k6c6
NoName057(16) è un gruppo di hacker che si è dichiarato a marzo del 2022 a supporto della Federazione Russa. Hanno rivendicato la responsabilità di attacchi informatici a paesi come l’Ucraina, gli Stati Uniti e altri vari paesi europei. Questi attacchi vengono in genere eseguiti su agenzie governative, media e siti Web di società private.
Che cos’è un attacco Distributed Denial of Service
Un attacco DDoS (Distributed Denial of Service) è un tipo di attacco informatico in cui vengono inviate una grande quantità di richieste a un server o a un sito web da molte macchine diverse contemporaneamente, al fine di sovraccaricare le risorse del server e renderlo inaccessibile ai suoi utenti legittimi.
Queste richieste possono essere inviate da un grande numero di dispositivi infetti da malware e controllati da un’organizzazione criminale, da una rete di computer compromessi chiamata botnet, o da altre fonti di traffico non legittime. L’obiettivo di un attacco DDoS è spesso quello di interrompere le attività online di un’organizzazione o di un’azienda, o di costringerla a pagare un riscatto per ripristinare l’accesso ai propri servizi online.
Gli attacchi DDoS possono causare danni significativi alle attività online di un’organizzazione, inclusi tempi di inattività prolungati, perdita di dati e danni reputazionali. Per proteggersi da questi attacchi, le organizzazioni possono adottare misure di sicurezza come la limitazione del traffico di rete proveniente da fonti sospette, l’utilizzo di servizi di protezione contro gli attacchi DDoS o la progettazione di sistemi resistenti agli attacchi DDoS.
Occorre precisare che gli attacchi di tipo DDoS, seppur provocano un disservizio temporaneo ai sistemi, non hanno impatti sulla Riservatezza e Integrità dei dati, ma solo sulla loro disponibilità. pertanto una volta concluso l’attacco DDoS, il sito riprende a funzionare esattamente come prima.
Che cos’è l’hacktivismo cibernetico
L’hacktivismo cibernetico è un movimento che si serve delle tecniche di hacking informatico per promuovere un messaggio politico o sociale. Gli hacktivisti usano le loro abilità informatiche per svolgere azioni online come l’accesso non autorizzato a siti web o a reti informatiche, la diffusione di informazioni riservate o il blocco dei servizi online di una determinata organizzazione.
L’obiettivo dell’hacktivismo cibernetico è di sensibilizzare l’opinione pubblica su questioni importanti come la libertà di espressione, la privacy, la libertà di accesso all’informazione o la lotta contro la censura online. Gli hacktivisti possono appartenere a gruppi organizzati o agire individualmente, ma in entrambi i casi utilizzano le loro competenze informatiche per creare un impatto sociale e politico.
È importante sottolineare che l’hacktivismo cibernetico non deve essere confuso con il cybercrime, ovvero la pratica di utilizzare le tecniche di hacking per scopi illeciti come il furto di dati personali o finanziari. Mentre il cybercrime è illegale, l’hacktivismo cibernetico può essere considerato legittimo se mira a portare all’attenzione pubblica questioni importanti e a favorire il dibattito democratico. Tuttavia, le azioni degli hacktivisti possono avere conseguenze legali e gli hacktivisti possono essere perseguiti per le loro azioni.
Chi sono gli hacktivisti di NoName057(16)
NoName057(16) è un gruppo di hacker che si è dichiarato a marzo del 2022 a supporto della Federazione Russa. Hanno rivendicato la responsabilità di attacchi informatici a paesi come l’Ucraina, gli Stati Uniti e altri vari paesi europei. Questi attacchi vengono in genere eseguiti su agenzie governative, media e siti Web di società private
Le informazioni sugli attacchi effettuati da NoName057(16) sono pubblicate nell’omonimo canale di messaggistica di Telegram. Secondo i media ucraini, il gruppo è anche coinvolto nell’invio di lettere di minaccia ai giornalisti ucraini. Gli hacker hanno guadagnato la loro popolarità durante una serie di massicci attacchi DDOS sui siti web lituani.
Le tecniche di attacco DDoS utilizzate dal gruppo sono miste, prediligendo la “Slow http attack”.
L'articolo Italia sotto attacco DDoS da parte dei filorussi di NoName057(16)? Pochi disservizi proviene da il blog della sicurezza informatica.
Give Your Band The Music Of The Bands
The way to get into radio, and thence electronics, in the middle years of the last century, was to fire up a shortwave receiver and tune across the bands. In the days when every country worth its salt had a shortwave station, Cold War adversaries boomed propaganda across the airwaves, and even radio amateurs used AM that could be listened to on a consumer radio, a session in front of the dial was sure to turn up a few surprises. It’s a lost world in the 21st century, as the Internet has provided an easier worldwide medium and switch-mode power supplies have created a blanket of noise. The sounds of shortwave are thus no longer well known to anyone but a few enthusiasts, but that hasn’t stopped [gnd buzz] investigating their potential in electronic music.
There’s very little on the air which couldn’t be used in some form by the musician, but the samples are best used as the base for further processing. One example takes a “buzzer” signal and turns it into a bass instrument. The page introduces the different types of things which can be found on the bands, for which with the prevalence of WebSDRs there has never been a lower barrier to entry.
If you’re too young to have scanned the bands, a capable receiver can now be had for surprisingly little.
Radio dial header: Maximilian Schönherr, CC BY-SA 3.0.
Phishing con stile! I cyber criminali allegano GIF dei supereroi nel malware
Gli analisti di F6 hanno pubblicato uno studio su una nuova campagna di phishing attiva dalla primavera del 2025. Il gruppo, denominato ComicForm, ha inviato e-mail contenenti allegati dannosi ad aziende russe, bielorusse e kazake nei settori industriale, finanziario, turistico, biotecnologico e altri.
La prima e-mail registrata con oggetto “Report di verifica per firma” è stata inviata il 3 giugno 2025. L’allegato conteneva un archivio contenente un file eseguibile che ha avviato una catena di infezione in più fasi.
Durante l’attivazione, sono stati scaricati un loader .NET offuscato, il modulo MechMatrix Pro.dll e il dropper Montero.dll. Quest’ultimo è rimasto nel sistema, si è aggiunto alle eccezioni di Windows Defender, ha iniettato il payload nei processi e ha avviato lo spyware FormBook.
Una scoperta curiosa è stata la presenza di animazioni GIF di supereroi da Tumblr e Giphy incorporate nel codice del malware. Queste non sono state utilizzate nell’attacco, ma è stata proprio questa “estetica” a far guadagnare agli aggressori il soprannome ComicForm.
La caratteristica principale delle email era l’indirizzo di ritorno rivet_kz@…, registrato presso un servizio di posta elettronica gratuito. Le email provenivano dai domini .ru, .by e .kz, contenevano oggetti relativi a fatture, contratti e documenti bancari ed erano accompagnate da archivi con file infetti. In alcuni casi, provenivano dagli indirizzi IP 185.130.251[.]14, 185.246.210[.]198 e 37.22.64[.]155. Una delle email era stata inviata a un indirizzo email aziendale di Beeline Kazakhstan.
Successivamente, il 25 luglio, F6 ha rilevato una nuova ondata di email inviate per conto di un’azienda kazaka. Le email contenevano un link “Conferma password” che conduceva a una pagina di accesso falsa. Le informazioni di accesso della vittima venivano inviate a una risorsa di terze parti e il codice della pagina inseriva automaticamente l’indirizzo email dell’utente e aggiungeva uno screenshot del sito web aziendale per aumentare la credibilità.
Un’analisi dell’infrastruttura ha rivelato l’utilizzo di un’ampia gamma di domini nelle aree .ru, .kz, .vn, .id, .ng, .glitch.me e altre. Alcune risorse sono state compromesse. Gli esperti hanno riscontrato somiglianze con un attacco dell’aprile 2025 a una banca bielorussa, che ha utilizzato tecniche e servizi simili per rubare dati tramite la piattaforma Formspark.
ComicForm rimane attivo a partire da settembre 2025, utilizzando sia la vecchia infrastruttura che i nuovi domini. Tuttavia, l’indirizzo rivet_kz@….ru non compare più nelle mailing list recenti. L’analisi del grafico ha rivelato un’espansione della rete di risorse utilizzate dagli aggressori.
F6 ha concluso che ComicForm è attivo almeno da aprile 2025, prendendo di mira organizzazioni di diversi paesi e settori. Il gruppo combina l’invio di email tramite FormBook con la creazione di pagine di phishing che impersonano servizi aziendali.
L'articolo Phishing con stile! I cyber criminali allegano GIF dei supereroi nel malware proviene da il blog della sicurezza informatica.
Un manifesto dopo 72 ore! I Criminali Informatici si ritireranno davvero?
Quindici tra i più noti gruppi di criminali informatici, tra cuiScattered Spider, ShinyHunters e Lapsus$, hanno annunciato la loro chiusura. La loro dichiarazione collettiva, pubblicata su BreachForums, è il messaggio più esplicito proveniente dall’underground degli ultimi anni.
Il gruppo ha sottolineato che il loro obiettivo non era tanto l’estorsione quanto dimostrare la debolezza dei sistemi digitali. Ora, tuttavia, hanno dichiarato di preferire il “silenzio” agli attacchi pubblici.
Il documento, pubblicato sotto diversi pseudonimi di noti hacker, sostiene che la decisione sia stata presa dopo tre giorni di silenzio, dedicati dai partecipanti alle proprie famiglie e alla revisione dei propri piani in caso di persecuzione. Hanno affermato di aver “aspettato a lungo” nelle ultime 72 ore per confermare finalmente la loro strategia di uscita e il loro allineamento interno.
Il testo elenca gli incidenti di alto profilo degli ultimi mesi. Tra questi, la chiusura degli stabilimenti Jaguar, gli attacchi a Google che avrebbero interessato i servizi Workspace, Gmail e Person Finder, e gli attacchi all’infrastruttura di Salesforce e CrowdStrike. Gli autori hanno sottolineato di aver deliberatamente bloccato il progresso di alcuni attacchi informatici, lasciando le aziende nel limbo, e di aver gradualmente abbandonato i propri strumenti, tra cui il servizio di posta elettronica Tutanota.
La dichiarazione contiene anche avvertimenti diretti. Cita Kering, Air France, American Airlines, British Airways e altre grandi aziende che, secondo il gruppo, non hanno ancora ricevuto richieste di riscatto, nonostante la possibilità che i loro dati siano già stati compromessi. Il messaggio sottolinea che i governi di Stati Uniti, Regno Unito, Francia e Australia si illudono di avere il controllo della situazione, mentre gli aggressori continuano a monitorarne le attività.
Particolare enfasi è posta sugli arresti. Gli hacker hanno espresso solidarietà per gli otto detenuti, quattro dei quali si trovano nelle carceri francesi, definendoli “capri espiatori”. Hanno affermato che questi individui erano vittime delle indagini, ma non vi erano prove credibili a loro carico. Gli autori hanno affermato di aver intenzionalmente lasciato tracce per depistare le indagini e ridurre i rischi per i veri partecipanti, utilizzando tecniche di ingegneria sociale .
I conflitti con le forze dell’ordine e le agenzie di intelligence sono specificamente menzionati. Il testo afferma che i partecipanti hanno appreso tecniche di distrazione dai “migliori”, citando direttamente l’esperienza della CIA e le “lezioni di Langley”. Sottolineano che, a lungo termine, la pianificazione e l’influenza sono più importanti dell’abilità tecnica.
La parte finale della dichiarazione suona come un addio.
I gruppi di hacker affermano che i loro compiti sono completati ed è ora di sparire. Alcuni intendono “godersi i loro paracaduti d’oro” e accumulare milioni, altri intendono concentrarsi sulla ricerca e sullo sviluppo tecnologico, e altri ancora si ritireranno semplicemente nell’ombra. Gli autori, tuttavia, non hanno escluso la possibilità che i loro nomi continuino a emergere in future pubblicazioni sugli attacchi informatici ai danni di aziende e agenzie governative, ma hanno sottolineato che ciò non significa che continueranno a essere attivi.
Nonostante il roboante manifesto d’addio, gli analisti sono scettici sulla situazione attuale. Black Duck ha avvertito che tali dichiarazioni dovrebbero essere prese con cautela: spesso indicano solo una ritirata temporanea. BeyondTrust ha aggiunto che la storia di GandCrab, che “se n’è andato” nel 2019 ed è tornato come REvil, ha dimostrato che gli annunci clamorosi nel mondo criminale raramente sono definitivi. Bugcrowd ha sottolineato che i criminali si stanno riorganizzando o creando nuove strutture, mentre iCOUNTER ha definito tali processi parte del normale ciclo dell’underground.
Pertanto, la “dipartita” simultanea di quindici gruppi è stata un evento degno di nota nel mondo della criminalità informatica, ma non rappresenta affatto la vera scomparsa della minaccia. Cambiare nomi e ruoli non elimina il fenomeno ransomware in sé ; si limita a mascherarlo, lasciando aziende ed enti governativi esposti agli stessi rischi.
We apologise for our silence and the ambiguities of our message, whose sole destinataries did not understand the profound meaning.
These 72 hours spent in silence have been important for us to speak with our families, our relatives, and to confirm the efficiency of our contingency plans and our intents.
These 72 hours had hoped for a long time.
As you know, the last weeks have been hectic. Whilst we were diverting you, the FBI, Mandiant, and a few others by paralyzing Jaguar factories, (superficially) hacking Google 4 times, blowing up Salesforce and CrowdStrike defences, the final parts of our contingency plans were being activated.
You might or might not have realized, but our behaviour evolved recently. When we entered into Google systems, we decided not to pursue over a certain point. In between others, we willingly left them in wonder of whether Google's Workspace, Person Finder, GMAIL including legacy branches got dominated.
This has been happening more and more, as we decided to progressively abandon some of our tools (Hello, Tutanota) and our correspondents to their own faith.
Will Kering, Air France, American Airlines, British Airlines, and among many other critical infrastructure face THE CONSEQUENCES OF THEIR PUBLIC OR SECRET databreaches? I'd wonder too if I was them, as they know some have yet to receive any demand for ransom - or anything else.
Are their data currently being exploited, whilst US, UK, AU, and French authorities fill themselves with the illusions thinking they have gotten the situation under control?
Do they know that we're observing them as they painfully try to upload their HD logos to the BF servers? As they painfully try to convince judges that they have found, for the second time in a row, the real Hollow? As they pretend to arrest members of the real dark forces, on the other side of the Mediterranean, to better protect the system and its real leaders?
Have they not realized we were everywhere?
Vanity is never but an ephemeral triumph. And manipulation of opinion is never anything else than vanity.
This is why we have decided that silence will now be our strength.
You may see our names in new databreach disclosure reports from the tens of other multi billion dollar companies that have yet to disclose a breach, as well as some governmental agencies, including highly secured ones, that does not mean we are still active.
Judicial decisions will keep on busy police officers, magistrates and journalists.
They will all be dead traces of the past.
We want to share a thought for the eight people that have been raided or arrested in relations to these campaigns, Scattered Spider and/or ShinyHunters groups since beginning on April 2024 and thereafter 2025, and especially to the four who are now in custody in France.
We want to expand our regrets to their relatives, and apologise for their sacrifice. Any State needs its scapegoat. Those carefully selected targets are the last collateral victims of our war on power, and the use of our skills to humiliate those who have humiliated, predate those who have predated. We have ensured that the investigations targeting them will progressively fall apart, and that their mild vanity peccati will not inflict on them, long term consequences.
We have done so by ensuring that enough of our dirty laundry would hint to them, whilst keeping them away from any serious liability. We've learnt this from the best. This fine, funambulist equilibrium, so few are capable of reaching, is taught on an every day basis at Langley.
This is the last lesson we wanted to share with you. Talent and skill is not everything. Planning and power rule the world.
We will not try to help anyone anymore, directly or indirectly, to establish their innocence.
We've decided to let go.
It is now time to offer you what you have been waiting for. The truth.
We LAPSUS$, Trihash, Yurosh, yaxsh, WyTroZz, N3z0x, Nitroz, TOXIQUEROOT, Prosox, Pertinax, Kurosh, Clown, IntelBroker, Scattered Spider, Yukari, and among many others, have decided to go dark.
Our objectives having been fulfilled, it is now time to say goodbye.
If you worry about us, don't. The most stupid (Yurosh, Intel - say hi, you poor La Santé impersonator) will enjoy our golden parachutes with the millions the group accumulated. Others will keep on studying and improving systems you use in your daily lifes. In silence.
Others finally will just go gentle into that good night.
Thank you to everyone who has watched and stuck around.
Goodbye.
L'articolo Un manifesto dopo 72 ore! I Criminali Informatici si ritireranno davvero? proviene da il blog della sicurezza informatica.
When Is Your Pyrex Not The Pyrex You Expect?
It’s not often that Hackaday brings you something from a cooking channel, but [I Want To Cook] has a fascinating look at Pyrex glassware that’s definitely worth watching. If you know anything about Pyrex it’s probably that it’s the glass you’ll see in laboratories and many pieces of cookware, and its special trick is that it can handle high temperatures. The video takes a look at this, and reveals that not all Pyrex is the same.
Pyrex was a Corning product from the early 20th century, and aside from its many laboratory and industrial applications has been the go-to brand for casserole dishes and much more in the kitchen ever since. It’s a borosilicate glass, which is what gives it the special properties, or at least in some cases it used to be a borosilicate glass. It seems that modern-day American Pyrex for the kitchen is instead a soda glass, which while it still makes a fine pie dish, doesn’t quite have the properties of the original.
The video explains some of the differences, as well as revealing that the American version is branded in lower case as pyrex while the European version is branded uppercase as PYREX and retains the borosilicate formulation. Frustratingly there’s no quick way to definitively tell whether a piece of lower-case pyrex is soda glass or not, because the brand switch happened before the formulation switch.
In all probability in the kitchen it makes little difference which version you own, because most users won’t give it the extreme thermal shock required to break the soda version. But some Hackaday readers do plenty of experiments pushing the limits of their glassware, so it’s as well to know that seeking out an older PYREX dish could be a good move.
If you’d like to know more about glass, we’ve got you covered.
youtube.com/embed/2DKasz4xFC0?…
Getting the Most out of ISM Transceivers Using Math
WiFi is an excellent protocol, but it certainly has its weaknesses. Its range in even a normal home is relatively limited, so you could imagine the sort of performance you’d expect through the hundred meters of dense woodland that [DO3RB] is trying to penetrate. So naturally the solution was to develop a new wireless transceiver for the ISM band.
Of course, getting reliable packet transmission is tough. In a building with brick walls, WiFi will get around five to ten percent packet loss. For TCP to remain reliable, one percent packet loss is the maximum designed loss of this wireless protocol. In reality, the transceiver achieves 0.075% packet loss real world.
The crux of the magic behind this excellent reliability is the extended binary Golay code. By halving the bitrate, the Golay code is able to correct for up to four errors per codeword. While a more complicated scheme could have been used, the Golay code allowed for easy porting to an MCU thus simplifying the project. All this is encoded with frequency shift keying in the ISM band.
This magic is tied up inside an tiny SAMD21 paired with a RFM12BP wireless front end. Using TinyUSB, the interface shows up to the host as a USB Ethernet adapter making for seamless networking setups. With reliable bi-directional communication, you could theoretically use this as a home networking solution. However, this is realistically best for IoT devices as the speeds are around 56 kbit/s.
While this is an incredibly simple system, harking back to 90s networking, it certainly gets the job done in a neat and tidy manner. And if you too wish hark back to 90s radio communications, make sure to check out this satellite imagery hack next!
Thanks [Bernerd] for the tip!
It’s A Variable Capacitor, But Not As We Know It
Radio experimenters often need a variable capacitor to tune their circuits, as the saying goes, for maximum smoke. In decades past these were readily available from almost any scrap radio, but the varicap diode and then the PLL have removed the need for them in consumer electronics. There have been various attempts at building variable capacitors, and here’s [radiofun232] with a novel approach.
A traditional tuning capacitor has a set of meshed semicircular plates that have more of their surface facing each other depending on how far their shaft is turned. The capacitor presented in the first video below has two plates joined by a hinge in a similar manner to the covers of a book. It’s made of tinplate, and the plates can be opened or closed by means of a screw.
The result is a capacitor with a range from 50 to 150 picofarads, and in the second video we can see it used with a simple transistor oscillator to make a variable frequency oscillator. This can form the basis of a simple direct conversion receiver.
We like this device, it’s simple and a bit rough and ready, but it’s a very effective. If you’d like to see another unusual take on a variable capacitor, take a look at this one using drinks cans.
youtube.com/embed/ZPH6YKi-nzI?…
youtube.com/embed/iP3CnMHhO7Y?…